I have a host that is sending syslog entries with a couple of different formats. I have resolved how to roll multiline inputs into a single event, however, it has caused a problem with timestamp extraction on some subsequent events with a different format. Here are some example inputs from the same host:
This works, however, the time is no longer being extracted properly from the last event listed. If I remove the TIME_PREFIX, TIME_FORMAT and MAX_TIMESTAMP_LOOKAHEAD, things seem to work. However, those entries were recommended by Splunk Support and I wonder how necessary they are. Is there a way to help with the extraction given the different formats or should I just leave the time related functions out of props.conf?