I have configuration for TA-MS-AAD and we see that we have delays
trying to understand how _time is set
If I understand this correctly, this is for this add-on: https://splunkbase.splunk.com/app/3757
Which sourcetype are you seeing _time issues with? Each sourcetype has a different method of getting _time (some use "createdDateTime", others use CURRENT).