Rules (XQL)
[INGEST:vendor="salesforce", product="audit", target_dataset="salesforce_audit_raw", no_hit = keep]
filter CreatedDate ~= "\d{4}\-\d{2}\-\d{2}T\d{2}\:\d{2}\:\d{2}\.\d{3}[+-]\d{4}"
| alter
tmp_time_string = arrayindex(regextract(CreatedDate , "(\d{4}\-\d+\-\d+T\d+\:\d+\:\d+)"),0),
tmp_time_zone = arrayindex(regextract(CreatedDate , "(\.\d{3}[\+|\-]\d+)"),0)
| alter
tmp_full_time = concat(tmp_time_string , "", tmp_time_zone)
| alter
_time = parse_timestamp("%Y-%m-%dT%H:%M:%E3S%Z", tmp_full_time)
| fields -tmp_*;
[INGEST:vendor="salesforce", product="eventlogfile", target_dataset="salesforce_eventlogfile_raw", no_hit = keep]
filter to_string(TIMESTAMP_DERIVED) ~= "\d{4}\-\d{2}\-\d{2}T\d{2}\:\d{2}\:\d{2}\.\d{3}Z"
| alter tmp_time_string = arrayindex(regextract(to_string(TIMESTAMP_DERIVED), "\d{4}\-\d{2}\-\d{2}T\d{2}\:\d{2}\:\d{2}\.\d{3}Z"),0)
| alter _time = parse_timestamp("%Y-%m-%dT%H:%M:%E3SZ", tmp_time_string)
| fields -tmp_time_string;
[INGEST:vendor="salesforce", product="login", target_dataset="salesforce_login_raw", no_hit = keep]
filter to_string(TIMESTAMP_DERIVED) ~= "\d{4}\-\d{2}\-\d{2}T\d{2}\:\d{2}\:\d{2}\.\d{3}Z"
| alter tmp_time_string = arrayindex(regextract(to_string(TIMESTAMP_DERIVED), "\d{4}\-\d{2}\-\d{2}T\d{2}\:\d{2}\:\d{2}\.\d{3}Z"),0)
| alter _time = parse_timestamp("%Y-%m-%dT%H:%M:%E3SZ", tmp_time_string)
| fields -tmp_time_string;
[INGEST:vendor="salesforce", product="realtime", target_dataset="salesforce_realtime_raw", no_hit=keep]
filter to_string(EventDate) ~= "\d{4}\-\d{2}\-\d{2}T\d{2}\:\d{2}\:\d{2}\.\d{3}Z"
| alter tmp_time_string = arrayindex(regextract(to_string(EventDate), "\d{4}\-\d{2}\-\d{2}T\d{2}\:\d{2}\:\d{2}\.\d{3}Z"),0)
| alter _time = parse_timestamp("%Y-%m-%dT%H:%M:%E3SZ", tmp_time_string)
| fields -tmp_time_string;