[INGEST:vendor="Fortinet", product="Fortigate", target_dataset="fortinet_fortigate_raw", no_hit=keep]
filter to_string(FTNTFGTeventtime) ~= "\d{9}$"
| alter
    tmp_remove_milli_secs = to_integer(replex(FTNTFGTeventtime, "\d{9}$", "")),
    tmp_check_duration = if(FTNTFGTduration = null, 0, to_integer(FTNTFGTduration))
| alter
    tmp_substract_diff = subtract(tmp_remove_milli_secs, tmp_check_duration)
| alter
    _time = to_timestamp(tmp_substract_diff)
| fields -tmp_remove_milli_secs, tmp_check_duration, tmp_substract_diff
| fields FTNTFG*, act, _scope, app, c6a2, c6a3, cat, cefDeviceEventClassId, cefDeviceProduct, cefDeviceVendor, cefDeviceVersion, cefName, cefSeverity, cefVersion, cnt, destinationTranslatedAddress, destinationTranslatedPort, deviceDirection, deviceExternalId, deviceInboundInterface, deviceOutboundInterface, dhost, dpt, dst, duser, dvchost, externalID, externalId, fname, fsize, `in`, msg, out, outcome, proto, reason, request, requestClientApplication, requestContext, requestCookies, shost, sourceServiceName, sourceTranslatedAddress, sourceTranslatedPort, sproc, spt, src, suser;