Skip to main content
Question

Timestamp for the data in replay is not honoring the original timestamp

  • Mar 11, 2025 3:14 AM UTC
  • 7 replies
  • 101 views

I have a collector I've setup to replay data from s3, but it's not honoring the original timestamp in the data, even though the pipeline I'm sending it to sets the timestamp as the original :c any ideas? (example, I'm replaying data from 5th Feb, and the timestamp is being set to today, even though my autotimestamp function sets _time to the epoch for 2nd feb). Example in thread

7 replies

  • Author
  • Participating Frequently
  • Mar 11, 2025 4:38 AM UTC

preview IN


  • Author
  • Participating Frequently
  • Mar 11, 2025 4:38 AM UTC

preview OUT


  • Author
  • Participating Frequently
  • Mar 11, 2025 4:39 AM UTC

and then expected and actual results in splunk


  • Author
  • Participating Frequently
  • Mar 11, 2025 4:39 AM UTC

if I live watch the job in the job inspector I just see today's timestamp in the data


You'll need an event breaker configured that sets the `EdgeEndTimestamp` field as the timestamp


  • Author
  • Participating Frequently
  • Mar 11, 2025 4:39 AM UTC

ahh, okay, ty


Otherwise it defaults to current time