I have a similar issue as described in another question "JSON timestamps not parsed via HTTP Event Collector". But I'm seeing the issue only in a Splunk cluster setup. (Http request sending event to forwarder, then to indexer). Single node splunk instance works OK.
I've also tried to use the raw endpoint as described in the answer to the above question but still doesn't work. Event timestamp (_time) is always the current time of splunk server. Is there any way to have the splunk parse the timestamp inside the event in a forwarder setup?
Source type:
[xperf]
DATETIMECONFIG =
INDEXEDEXTRACTIONS = json
KVMODE = NONE
MAXTIMESTAMPLOOKAHEAD = -1
NOBINARYCHECK = true
TIMESTAMPFIELDS = runtimestamp
TIMEFORMAT = %s
TRUNCATE = 512000
category = Custom
pulldowntype = 1
curl -k -u "x:UUID" https://forwarder:8088/services/collector/raw?channel=XXXXX --data-binary @jsonfile.json
==json file===
[
{
"event": {
"key1": "value1",
"key2": "value2",
"runtimestamp": 1513024571
},
"index": "x-index",
"sourcetype": "x_perf"
}
]
