I know this is a dated question, but ran into the same issue. The solution for me was to increase MAX_DAYS_AGO in props.conf. Looks like based on your description of it not working for 6 year old data this was your issue as well. Since Splunk by default ignores dates over 5 1/2ish years old.
From the docs site:
Specifies the maximum number of days in the past, from the current date, that an extracted date can be valid.
For example, if MAX_DAYS_AGO = 10, Splunk software ignores dates older than 10 days from the current date and instead either uses the timestamp of the previous event, or uses the current index time of the event if it cannot determine a timestamp in the previous event.
The maximum settable number of days in the past is 10951.
Defaults to 2000 days
Note: If you have data that is more than 2000 days old, increase this setting.
... View more