How do I assign a current timestamp to an event vs. the event timestamp?

I have this really simple function enabled to configure current time as timestamp, but it doesn’t seem to work. it’s still taking timestamp from event.

The way you have it configured it will extract timestamp from the event. If you want current time, use an Eval to assign it. Eval info from the docs here: Eval | Cribl Docs

1 UpGoat