Can you share your props.conf file. i think you are forcing splunk to take _time as processedtime in logs ... View more

TCP has it's own compression standards same is applied here.   ... View more

Are you monitoring the path where the logs are written in the UF. can you share your inputs.conf ? this will help you check further. ... View more

what is the timezone your server is in. current_time takes current system time ... View more