Using the wrong time variable may prevent Splunk from matching your data. At best, it will only accept 3 decimal places.
Since %Q is the same as %3Q, which does not match microseconds, you should use %6Q.
I doubt this explains the 20-minute delay, however. Have you verified the clocks are correct on all systems?
--- If this reply helps you, an upvote would be appreciated.