ausearch_add_timestamp_item(3) on Linux

The text 200e01d8ad62, as Debian 12 (Bookworm), Debian 11 (Bullseye), Debian 10 (Buster), Debian 9 (Stretch), Debian 8 (Jessie) shipped it.

build up search rule