Setting the timestamp is somewhat convoluted. When I get the packets from IPC I callback into suricata with the timestamp, data, etc. rust/src/ipc.rs#L104 which eventually resolves to src/decode.c#L679 (forum is not liking the link to actual code right now)
There was a reason why I had it register as offline, but I no longer remember why, so I will try as live and see what happens.