Skip to main content
Question

Timestamp for the data in replay is not honoring the original timestamp

  • March 11, 2025
  • 7 replies
  • 14 views

I have a collector I've setup to replay data from s3, but it's not honoring the original timestamp in the data, even though the pipeline I'm sending it to sets the timestamp as the original :c any ideas? (example, I'm replaying data from 5th Feb, and the timestamp is being set to today, even though my autotimestamp function sets _time to the epoch for 2nd feb). Example in thread

7 replies

  • Author
  • Participating Frequently
  • March 11, 2025

preview IN


  • Author
  • Participating Frequently
  • March 11, 2025

preview OUT


  • Author
  • Participating Frequently
  • March 11, 2025

and then expected and actual results in splunk


  • Author
  • Participating Frequently
  • March 11, 2025

if I live watch the job in the job inspector I just see today's timestamp in the data


You'll need an event breaker configured that sets the `EdgeEndTimestamp` field as the timestamp


  • Author
  • Participating Frequently
  • March 11, 2025

ahh, okay, ty


Otherwise it defaults to current time