Yes. if you don't like your current _time at all, you can change your ingestion to use created_at as _time. (This is perhaps not the correct solution in most cases.) At search time, you can use calculated field to calculate epoch time from created_at and name it _time.
... View more