You need to set DATETIME_CONFIG to CURRENT in your props.conf:
DATETIME_CONFIG = CURRENT
Doing so will "will set the time of the event to the time that the event was merged from lines, or worded differently, the time it passed through the aggregator processor."
You need to do this on your heavy forwarder / indexer. Remember to restart Splunk after making changes to configuration files.