Hey @bowesmana , I checked with the admin team regarding props.conf settings. Unfortunately, we are not supposed to make changes to those file. Do we have another way to proceed? Below image shows the timestamps we are providing and the timestamp Splunk is considering. Thanks in advance.
... View more