ausearch_add_timestamp_item_ex(3) on Linux

The text cd280960d73c, as Debian 12 (Bookworm), Debian 11 (Bullseye), Debian 10 (Buster), Debian 9 (Stretch), Debian 8 (Jessie) shipped it.

build up search rule