[INGEST:vendor="microsoft", product="windows", target_dataset="microsoft_windows_raw", no_hit=keep]
filter time_created!= null
| alter _time = time_created;