SonicwallNSv Parsing Rule

Parsing Rule

SonicWall NSv

Details

IDSonicWallNSv Parsing Rule
From Version8.2.0

Source

SonicWallNSvParsingRules.xif SonicWallNSvParsingRules.yml
Download History Raw 
[INGEST:vendor="sonicwall", product="ns", target_dataset="sonicwall_ns_raw", no_hit=keep]
// Support only date time of format: yyyy-MM-dd hh:mm:ss. For example: "2021-12-08 10:00:00".
filter _raw_log ~= "time\=\"(\d{4,}-\d{2}-\d{2} \d{2}:\d{2}:\d{2})\sUTC\""
| alter timestamp = arrayindex(regextract(_raw_log,"time\=\"([^=]+)\sUTC\""),0)
| alter _time = parse_timestamp("%Y-%m-%d %H:%M:%S", timestamp)
| fields -timestamp;