Synopsys Coverity Parsing Rule

[INGEST:vendor="synopsys", product="coverity", target_dataset="synopsys_coverity_raw" , no_hit=keep]
  filter _raw_log -> timestamp ~= "\d{4}-\d{1,2}-\d{1,2}T\d{2}:\d{2}:\d{2}\.\d+[+|-]\d{2}\d{2}"
| alter _time = parse_timestamp("%FT%H:%M:%E*S%z", _raw_log -> timestamp);