Cisco Meraki Parsing Rule

[INGEST:vendor="cisco", product="meraki", target_dataset="cisco_meraki_raw", no_hit=keep]
filter _raw_log ~= "\s\d{9,10}\."
| alter 
    tmp_epoch_time = arraystring(regextract(_raw_log, "\s(\d{9,10})\."), ""),
    tmp_epoch_mili = arraystring(regextract(_raw_log, "\s\d+\.(\d{3})\d+"), "")
| alter 
    tmp_epoch_int = to_integer(concat(tmp_epoch_time, tmp_epoch_mili))
| alter 
    _time = to_timestamp(tmp_epoch_int, "millis")
| fields - tmp_epoch_time, tmp_epoch_mili, tmp_epoch_int;