Why the time of a part of the events are different from what the time field show?
And how to set the config to make time of events right?
There are numerous answers to your question, here are some, but you should go and some more for a better understanding:
I'm not exactly certain if I understand your question, but it sounds like you might need this: http://docs.splunk.com/Documentation/Splunk/latest/Data/Configuretimestamprecognition
Splunk doesn't get the event times from the logs.
You have to specify the time format explicitly to get the timing.
In props.conf
TIME_FORMAT= Log_time format e.g. y%:m%:d%
TIME_PREFIX=regex to get the time filed
MAX_TIMESTAMP_LOOKAHEAD= Specify the size of the time fields to look at
These are the most useful field to get it resolved. New index data will show the update but the old data stat as it is.