[MODEL: dataset = cisco_ucm_raw]
alter
    src_ipv4 = coalesce(parsed_fields -> IPAddress, arrayindex(regextract(parsed_fields -> DeviceIPv4Address ,"\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"),0), parsed_fields -> LoginFrom),
    src_ipv6 = coalesce(parsed_fields -> IPV6Address, arrayindex(regextract(parsed_fields -> DeviceIPv6Address ,"[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}"),0)),
    outcome = parsed_fields -> FailureDetail
| alter 
    xdm.event.id = to_string(arrayindex(regextract(_raw_log,"\<\d+\>(\d+):"),0)),
    xdm.observer.name = parsed_fields -> NodeID,
    xdm.observer.type = arrayindex(regextract(_raw_log,"%(UC.*?)-"),0),
    xdm.event.type = arrayindex(regextract(_raw_log,"%UC.*?\d+-([^:]+)"),0),
    xdm.target.port = to_integer(parsed_fields -> ConnectingPort),
    xdm.source.ipv4 = if(is_ipv4(src_ipv4), src_ipv4, null),
    xdm.source.ipv6 = if(is_ipv6(src_ipv6), src_ipv6, null),
    xdm.source.interface = parsed_fields -> MACAddress,
    xdm.source.host.mac_addresses = arraycreate(parsed_fields -> MACAddress),
    xdm.source.user.identifier = parsed_fields -> UserID,
    xdm.source.host.hostname = parsed_fields -> DeviceName,
    xdm.network.application_protocol = parsed_fields -> Protocol,
    xdm.event.description = arrayindex(regextract(_raw_log,"\]:(.*?)$"),0),
    xdm.alert.description = coalesce(parsed_fields -> AlertDetail, parsed_fields -> Message),
    xdm.source.user.username = coalesce(parsed_fields -> Description, parsed_fields -> StationDesc),
    xdm.event.outcome = if(outcome != null, XDM_CONST.OUTCOME_FAILED, null),
    xdm.event.outcome_reason = coalesce(to_string(parsed_fields -> Reason), to_string(parsed_fields -> FailureCause)),
    xdm.source.host.device_model = coalesce(to_string(parsed_fields -> DeviceType), to_string(parsed_fields -> ModelNumber));