Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Parsing rules fix filter 4 #28193

Merged
merged 10 commits into from
Jul 17, 2023
Merged

Parsing rules fix filter 4 #28193

Changes from 1 commit
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
5658b82
Added filter to cisco ASR parsing rule.
yasta5 Jul 16, 2023
d1e6297
Added release notes to cisco asr
yasta5 Jul 16, 2023
8e0b820
Added filter to cisco nexus parsing rule
yasta5 Jul 16, 2023
d2e7943
Added release note to cisco nexus
yasta5 Jul 16, 2023
6c58b96
Added filter to cisco SMA parsing rule
yasta5 Jul 16, 2023
806d6c3
Added release note to cisco SMA
yasta5 Jul 16, 2023
f2eeb9d
Added release note to cisco SMA
yasta5 Jul 16, 2023
e726bea
Merge branch 'master' into parsing_rules_fix_filter_4
yasta5 Jul 16, 2023
4a1c77d
Upadted the readme file.
yasta5 Jul 17, 2023
84305d0
Merge branch 'master' into parsing_rules_fix_filter_4
yasta5 Jul 17, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Added filter to cisco nexus parsing rule
  • Loading branch information
@yasta5
yasta5 committed Jul 16, 2023
commit 8e0b8209e0ffaf9a97eaa3b55c39afac50f21245
9 changes: 5 additions & 4 deletions Packs/CiscoNexus/ParsingRules/CiscoNexus_1_3/CiscoNexus_1_3.xif
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
[INGEST:vendor="cisco", product="nexus", target_dataset="cisco_nexus_raw", no_hit=keep]
filter _raw_log contains "UTC"
|alter tmp_time = arrayindex(regextract(_raw_log ,"\:\s(\d{4}\s\w{3}\s+\d{1,2}\s\d{2}\:\d{2}\:\d{2})\sUTC"),0)
|alter _time=parse_timestamp("%Y %b %d %H:%M:%S",tmp_time)
|fields -tmp_time;
// Support only date time of format: yyyy MMM dd hh:mm:ss. For example: "2021 Jan 01 10:00:00".
filter _raw_log ~= "\:\s(\d{4}\s\w{3}\s+\d{1,2}\s\d{2}\:\d{2}\:\d{2})\sUTC"
| alter tmp_time = arrayindex(regextract(_raw_log ,"\:\s(\d{4}\s\w{3}\s+\d{1,2}\s\d{2}\:\d{2}\:\d{2})\sUTC"),0)
| alter _time=parse_timestamp("%Y %b %d %H:%M:%S",tmp_time)
| fields -tmp_time;