Okay, first thing, you will save yourself a WHOLE lot of pain if you have your indexer (really all your hosts) running UTC. I realize you don't have personal control over that, but it is something to mention to the senior techs pretty much every time this kind of thing comes up. Eventually when they propose this great bright idea to move everything over to UTC, you just keep your mouth shut and nod, so it gets done and a bunch of your headaches go away.
Second thing, have you verified that your indexers are not backlogged? (Assuming you were really talking about indextime, which has nothing to do with the event _time.) It is not great for them to be taking 15 minutes to catch up to ingest a particular event, but it's not an error.
Third, verify that your time configuration in props.conf for the appropriate sourcetype matches the event. Looks to me like your look-ahead needs to be at least 38-40 characters, and the time format should be this -
%Y-%m-%dT%H:%M:%S.%6N%:z
