Log file - small subset of entries lacks timestamp - how to fix at index time?

[nem]

Hey guys,

I'm having a bit of a hard time with a few events in our game's log files. I would've changed the logging format, but it is part of the game engine which means I cannot just change it.

Log file open, 05/09/15 23:24:39
LogInit:Display: Running engine for game: MyGame
LogInit: Version: 4.7.6-0+++depot+UE4-Releases+4.7
LogInit: API Version: 0
LogInit: Compiled (64-bit): May  5 2015 00:09:28
LogInit: Compiled with Visual C++: 18.00.31101.00
LogInit: Build Configuration: Development
LogInit: Branch Name: ++depot+UE4-Releases+4.7
LogInit: Command line:  
LogInit: Base directory: W:/UE4.7.X/UnrealEngine/Engine/Binaries/Win64/
LogInit: Rocket: 0
[2015.05.09-21.24.39:186][  0]LogTaskGraph: Started task graph with 3 named threads and 6 total threads.
[2015.05.09-21.24.39:394][  0]LogOnline:Display: STEAM: Loading Steam SDK 1.30
[2015.05.09-21.24.39:396][  0]LogOnline:Warning: STEAM: Steam API disabled!
[2015.05.09-21.24.39:396][  0]LogOnline:Display: STEAM: OnlineSubsystemSteam::Shutdown()
[2015.05.09-21.24.39:397][  0]LogOnline:Warning: Unable to create OnlineSubsystem module Steam
[-- rest of the output omitted --]

Ideally all these lines without a timestamp should receive the timestamp from the first line. What's the proper way of doing this?
It would also be okay if all events without timestamp were to be indexed as a multiline events, but right now the game's build date in line 5 is being interpreted as event timestamp and prevents splunk from grouping the events without timestamp together.

[woodcock]

Use this in props.conf:

TIME_PREFIX = \[
TIME_FORMAT = %Y\.%m\.%d-%H\.%M\.%S:%3N
MAX_TIMESTAMP_LOOKAHEAD = 23

Each event that does not have a timestamp will be given the timestamp of the previous event.