dataset = xdr_data
| fields action_boot_time as abt
| filter abt != null
| target type=dataset abt_dataset
Subsequently, you can query the new dataset. Notice that the field names used
by the new dataset conform to the aliases that you used when you created the dataset:
dataset = abt_dataset
| filter abt = 1603986614040