[INGEST:vendor="MSFT", product="Intune", target_dataset="msft_intune_raw", no_hit=keep]
filter to_string(time) ~= "\d{4}\-\d{2}\-\d{2}T\d{2}:\d{2}:\d{2}[\.\dZ]*"
| alter
    tmp_timestampModify = trim(to_string(time), "Z")
| alter
    tmp_splitStr = split(tmp_timestampModify, ".")
| alter 
    tmp_epoch_s = to_string(to_epoch(parse_timestamp("%Y-%m-%dT%H:%M:%S", arrayindex(tmp_splitStr ,0)), "seconds")),
    tmp_epoch_ms = coalesce(trim(arrayindex(tmp_splitStr, 1),"Z"), "")
| alter
    tmp_epoch_ms_check = if(
        to_string(len(tmp_epoch_ms)) = "0", "", 
        to_string(len(tmp_epoch_ms)) ~= "3|4|5", arrayindex(regextract(tmp_epoch_ms, "^\d{3}"), 0),  
        to_string(len(tmp_epoch_ms)) ~= "6|7|8", arrayindex(regextract(tmp_epoch_ms, "^\d{6}"), 0),
        to_string(len(tmp_epoch_ms)) = "9", arrayindex(regextract(tmp_epoch_ms, "^\d{9}"), 0)
    )
| alter 
    tmp_set_timestamp = if(
        to_string(len(tmp_epoch_ms)) = "0", to_timestamp(to_integer(concat(tmp_epoch_s , tmp_epoch_ms_check)), "SECONDS"),
        to_string(len(tmp_epoch_ms)) ~= "3|4|5", to_timestamp(to_integer(concat(tmp_epoch_s , tmp_epoch_ms_check)), "MILLIS"),
        to_string(len(tmp_epoch_ms)) ~= "6|7|8", to_timestamp(to_integer(concat(tmp_epoch_s , tmp_epoch_ms_check)), "MICROS"),
        to_string(len(tmp_epoch_ms)) ~= "9", to_timestamp(floor(divide(to_integer(concat(tmp_epoch_s , tmp_epoch_ms_check)), 1000)), "MICROS"),
        to_timestamp(to_integer(tmp_epoch_s), "SECONDS")
    )
| alter 
    _time = tmp_set_timestamp
| fields -tmp*;