The way I read your question, "extract time manually for a span of minutes" it sounds like you want to include the earliest, and latest span in your search.
index=blah sourcetype=foo earliest="4/20/2015:20:00:00" latest="4/20/2015:20:22:00"|stats count by whatever
If you want to know how to get Splunk to extract either the first or second timestamp in your log, you will need to decide which one. They seem to be indicating different timezones as the first one is 11pm and the 2nd one is 8pm. So pick one...
Those are settings that you want to apply in props.conf. In fact, if it is the first one... just add LINE_BREAKER=([\r\n]+)\d\/\d{2}\/\d{2} to props.conf under the stanza for this source/sourcetype and Splunk will grab the first one. if you want the second one, then you would add LINE_BREAKER and TIME_PREFIX which in this case is nice and easy, as it begins with a left square bracket.
All together it would look like this:
[sourcetypename]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)\d\/\d{2}\/\d{2}
TIME_PREFIX = \[
With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
