Your statement is not entirely true. The Real-time search is the only portion that streams live/continous view of events, which I dont think you are using. When you run a search that does not include real-time you are just running report. Splunk will extracted _time from your log/event at time of index based on your props.conf. If you want Splunk to use the RECORD_DATE for your events timestamp you need to configure you props.conf for that source/sourcetype on your indexers. #props.conf stanza example (only an example) [RECORD] NO_BINARY_CHECK=1 SHOULD_LINEMERGE=false MAX_TIMESTAMP_LOOKAHEAD=38 TIME_PREFIX=RECORD_DATE= TIME_FORMAT="%Y%m%d%H%M" Additional Reading: Aboutsearch Indextimeversussearchtime Handleeventtimestamps Propsconf Aboutrealtimesearches Hope this help you or gets you started. Dont forget to vote and accept answers that help. ... View more