The cited manual describes how to use _time in a search, but the problem you describe happens at index time and so is not covered by that manual. Please tell us how the log gets from your application to Splunk.  Also, how much lag are you seeing?  Is there a sourcetype defined in props.conf for the data?  If so, what are the settings?  Can you share a (sanitized) sample event or two?

If you use on-prem Splunk Enterprise then you can set the From email address to any value you wish.  If you use Splunk Cloud then the From address cannot be changed. Either way, I get the impression "+untrusted" is being added to the From field after the message leaves Splunk - probably by your email service.  You should talk to your email admin about that.

In these kinds of situations in Splunk I generally do something like this to replace empty strings with actual null values. | foreach err_field* [ | eval <<FIELD>>=if( '<<FIELD>>'=="" OR match('<<FIELD>>', "^\s*$"), null(), '<<FIELD>>' ) ] | eval err_final=coalesce(err_field1, err_field2, err_field3, err_field4)   You can see the coalesce works as expected after replacing nullifying the empty strings. Note: this is also replacing any values in the err_field* fields that is only whitespace in addition to empty strings.

Dashboard Studio is still under development so some features which are available in SimpleXML / Classic dashboards are either not available or not fully working, it will depend on which version of Splunk you are using.

Your LINE_BREAKER (and EVENT_BREAKER - they work very similarily but on different levels) makes no sense. This parameter is not used to find whole event. It is supposed to find and match (the part captured within the capture group is discarded as not belonging to either the preceeding or following event) the text which is _between_ events. That's why by default it matches ([\r\n]+) - it finds all sequences of continuous end of line characters, splits the stream where those sequences happen, and removes those sequences from the ingestion pipeline. In your case the situation is more complicated since you're trying to do a Bad Thing (tm) which is approach the structured data with simple regex manipulation. You could try to define your LINE_BREAKER as ^}(,[\r\n]+){ Which would mean that Splunk is to break the events in those places where you have only "}," alone in the line and immediately after that another "{" starts (possibly having several empty lines in between). But you're running into a risk of: 1) Incorrectly spliting your event in case you have a more complicated json structure 2) Laving the beginning and dangling square brackets as parts of the events (well, this one could be mitigated be editing the regex further but by expense of increasing risk number 1.  

If you're on Cloud, you can't send your syslog directly to cloud and need a local forwarder (or SC4S instance)  anyway. So it doesn't matter much whether it's TCP or UDP (at least in terms of on-site vs. Cloud).