This stanza matches what is set in the TCP receiver as the custom sourcetype for this port, but the timestamp isn't being properly extracted. I'm intentionally prefixing the field with a hyphen so Splunk will find it quickly in the event. Am I editing the wrong props.conf?
ended up solving it right after I posted this. I think it might be extra important to view the raw log and build the time prefix based on this, rather than attempt to guess based on the way Splunk shows JSON data all prettified.