More time formatting troubles time_format

[onlineops]

On the indexer, I have the following property config:
[host::newdatamine]
TIME_PREFIX = ^[INFO|ERROR|WARN]\s+[
TIME_FORMAT = %y.%m.%d\s+%H:%M:%S
BREAK_ONLY_BEFORE = [INFO|ERROR|WARN]

example logfile:
[INFO] [12.02.27 17:00:24] [mysp_Process_DataAffiliateAutoXML] Refresh data from lmAffiliateAttemptLog
[INFO] [12.02.27 17:00:42] [mysp_Process_DataAffiliateAutoXML] Processing data for 2012-02-26

Splunk now breaks the lines correctly and picks up the correct date. It does not pick up the correct time:

Splunk output:

1 2/29/12
12:02:29.000 PM

[INFO] [12.02.29 19:00:43] [mysp_Process_DataAffiliateAutoXML] Refresh data from lmAffiliateAttemptLog

* host=NEWDATAMINE   Options|  
* sourcetype=newdatamine-too_small   Options|  
* source=C:\DataWarehouse_Report\Splunk\newdatamine.log   Options

2 2/29/12
12:02:29.000 PM

[INFO] [12.02.29 15:21:28] [mysp_Process_DataAffiliateAutoXML] Processing data for 2012-02-28

* host=NEWDATAMINE   Options|  
* sourcetype=newdatamine-too_small   Options|  
* source=C:\DataWarehouse_Report\Splunk\newdatamine.log   Options

[onlineops]

It looks like my mistake was thinking that TIME_FORMAT would do rex (regular expressions). Per docs, it doesn't look like it can... Resolved via the following:

[host::newdatamine]
TIME_PREFIX = ^[[A-Z]+]\s[
TIME_FORMAT = %y.%m.%d %H:%M:%S
BREAK_ONLY_BEFORE = [INFO|ERROR|WARN]