[INGEST:vendor="paloaltonetworks", product="saassecurity", target_dataset="paloaltonetworks_saassecurity_raw", no_hit = keep]
filter to_string(timestamp) ~= "\d{2}:\d{2}:\d{2}.*"
| alter _time = timestamp;