CCSE: CrowdStrike Certified SIEM Engineer

By CrowdStrike · Question Mode

QuestionQ16

VerifiedParsing and Normalization

Review the following log event:

\{"ts": "2018/11/01 14:31:10", "server": "webOl", "message": "Out of memory"\}

Which parsing function should be used to add a missing timezone field?

Explanation

A JSON log event must be parsed with parseJson(). The ts value uses the format yyyy/MM/dd HH:mm:ss, and parseTimestamp must target the ts field while specifying the missing Europe/Paris timezone.

Community Discussion

No comments yet. Be the first to start the discussion!