Details
| ID | jamf_ParsingRule |
|---|---|
| From Version | 8.4.0 |
| Tags | jamf |
Rules (XQL)
[INGEST:vendor="jamf", product="pro", target_dataset="jamf_pro_raw", no_hit=keep]
filter webhook != null AND to_string(webhook) ~= "eventTimestamp[^\d]+\d{13}"
| alter _time = to_timestamp(to_integer(json_extract_scalar(webhook, "$.eventTimestamp")), "millis");