I noticed lately (in a kinda painful way 😉) that if the time field is present in json sent to a HEC collector endpoint, the timestamp is not getting parsed from the message. But since the documentation differs between 8.0 and 7.x in this regard (https://docs.splunk.com/Documentation/Splunk/7.3.9/Data/HECRESTendpoints - doesn't say a word about timestamp parsing whereas 8.0.0 gives whole paragraph about optional parameter affecting the parsing) - does anyone know whether the 7.x versions behaved the same way?
I mean - did the timestamp parsing in 7.x also wasn't performed at all if the time field was present? Did the behaviour changed or was it simply that the docs were supplemented?
