[INGEST:vendor="aruba_networks", product="clearpass", target_dataset="aruba_networks_clearpass_raw", no_hit = keep]
filter to_string(rt) ~= "\d{13}"
| alter _time = to_timestamp(to_integer(rt), "MILLIS");