Rules (XQL)
[INGEST:vendor="cisco", product="ise", target_dataset="cisco_ise_raw", no_hit=keep]
// Support only date time of format: MMM dd hh:mm:ss or format: yyyy-MM-dd hh:mm:ss.nnn [+|-]nn:nn or format: yyyy-MM-dd hh:mm:ss.nnn [+|-]nnnn. For example: "Jan 01 10:00:00" or "2022-01-01 10:00:00.123 +03:00" or "2022-01-01 10:00:00.123 +0300".
filter _raw_log ~= "<\d+>\w+\s*\d+\s\d+:\d+:\d+\s" or _raw_log ~= "\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}\.\d{3}\s[+|-]\d+:?\d+\s"
| alter
tmp_time2 = arrayindex(regextract(_raw_log,"<\d+>(\w+\s*\d+\s\d+:\d+:\d+)\s"),0),
tmp_time1 = arrayindex(regextract(_raw_log,"(\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}\.\d{3}\s[+|-]\d+:?\d+)\s"),0),
tmp_Year = format_timestamp("%Y",_insert_time)
// Parsing time format 2
| alter tmp_time2_1 = concat(tmp_Year, " ", tmp_time2)
| alter tmp_time2_1 = parse_timestamp("%Y %b %e %H:%M:%S", tmp_time2_1)
| alter tmp_timeDiff = timestamp_diff(tmp_time2_1, current_time(), "MILLISECOND")
| alter tmp_Year2 = if(tmp_timeDiff > 0, to_string(subtract(to_integer(tmp_Year),1)),null)
| alter tmp_time2_2 = if(tmp_Year2 != null, concat(tmp_Year2, " ", tmp_time2), null)
| alter tmp_time2_2 = if(tmp_time2_2 != null, parse_timestamp("%Y %b %e %H:%M:%S", tmp_time2_2), null)
// Parsing time format 1
| alter tmp_time1 = parse_timestamp("%Y-%m-%d %H:%M:%E3S %Ez", tmp_time1)
| alter _time = coalesce(tmp_time1, tmp_time2_2, tmp_time2_1)
| fields -tmp_time1, tmp_time2, tmp_Year, tmp_Year2, tmp_time2_1, tmp_time2_2, tmp_timeDiff;