Skip to main content

I have a collector I've setup to replay data from s3, but it's not honoring the original timestamp in the data, even though the pipeline I'm sending it to sets the timestamp as the original :c any ideas? (example, I'm replaying data from 5th Feb, and the timestamp is being set to today, even though my autotimestamp function sets _time to the epoch for 2nd feb). Example in thread

preview IN

preview OUT

and then expected and actual results in splunk

if I live watch the job in the job inspector I just see today's timestamp in the data

You'll need an event breaker configured that sets the `EdgeEndTimestamp` field as the timestamp

ahh, okay, ty

Otherwise it defaults to current time

Reply


Terms & ConditionsCookie settings