Overriding event times in Splunk logs

[siaavush]

The problem is that there is a lag happening in the log shipping from our application to Splunk, after some investigation we realized that we can override the event time by providing _time property in the logs (ref:https://docs.splunk.com/Documentation/SCS/current/Search/Timestampsandtimeranges) and it should be UNIX epoch time (seconds).
we did that but it didn’t have any effect on the event time and the time difference persists.
It has been a while since we are testing a lot of possibilities yet none of them did the trick.

[richgalloway]

The cited manual describes how to use _time in a search, but the problem you describe happens at index time and so is not covered by that manual.

Please tell us how the log gets from your application to Splunk.  Also, how much lag are you seeing?  Is there a sourcetype defined in props.conf for the data?  If so, what are the settings?  Can you share a (sanitized) sample event or two?