Complete data sampling engine parsing

guilhemmarchand · Aug 19, 2020 · de3aecf · de3aecf
1 parent 772f16a
commit de3aecf
Show file tree

Hide file tree

Showing 2 changed files with 1 addition and 0 deletions.
diff --git a/trackme/default/macros.conf b/trackme/default/macros.conf
@@ -1393,6 +1393,7 @@ match(raw_sample, "^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}"), "raw_start_by_
 match(raw_sample, "^start_time=\"\w{3}\s\w{3}\s\d{2}\s\d{2}\:\d{2}\:\d{2}\s\d{4}\""), "raw_start_by start_time=\"%a %b %d %H:%M:%S %Y",\
 match(raw_sample, "^InsertedAt=\"\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}\""), "raw_start_by InsertedAt=\"%Y-%m-%d %H:%M:%S",\
 match(raw_sample, "^\d{4}\/\d{2}\/\d{2}\s\d{2}:\d{2}:\d{2}\s"), "raw_start_by_timestamp %Y/%m/%d %H:%M:%S",\
+match(raw_sample, "^\w{3}\s*\d{1,2}\s*\w{3}\s*\d{4}\s*\d{1,2}:\d{1,2}:\d{1,2}\s"), "raw_start_by_timestamp %a %d %b %Y %H:%M:%S",\
 match(raw_sample, ".*"), "raw_not_identified"\
 )\
 | eval $dest_field$_id=md5($dest_field$)

diff --git a/trackme_1221.tgz b/trackme_1221.tgz