Timestamp for the data in replay is not honoring the original timestamp
Sirius Lange
Posts: 10 ✭
I have a collector I've setup to replay data from s3, but it's not honoring the original timestamp in the data, even though the pipeline I'm sending it to sets the timestamp as the original :c any ideas? (example, I'm replaying data from 5th Feb, and the timestamp is being set to today, even though my autotimestamp function sets _time to the epoch for 2nd feb). Example in thread
0
Answers
-
preview IN
0 -
preview OUT
0 -
and then expected and actual results in splunk
0 -
if I live watch the job in the job inspector I just see today's timestamp in the data
0 -
You'll need an event breaker configured that sets the `EdgeEndTimestamp` field as the timestamp
0 -
Otherwise it defaults to current time
0 -
ahh, okay, ty
0
