We have updated our Terms of Service, Code of Conduct, and Addendum.

Auto Timestamp Extraction, Discovery, and Event Breaking Question

I have a REST collector that is using Discover to collect the ID of the log I'm importing. Then an event breaker using the File Header break type. The issue is that I don't know what version of the event the Auto Timestamp extractor tries to process. The event from discovery where the format is JSON or the raw event during breaking.

When I run the preview from the REST collector, I have have fields I can work with for the auto extraction unless auto extraction only works on the raw event which is CSV.