Slack Parsing Rule

Details

Rules (XQL)

[INGEST:vendor="slack", product="slack", target_dataset="slack_slack_raw", no_hit=keep]
filter to_string(date_create) ~= "\d{10}"
| alter _time = parse_timestamp("%s",to_string(date_create));