Splunk pulling the date from log data - not timestamp

[hharvey]

I have two types of logs that are formatted thusly:

hostname app->name: date time log data

and

hostname:date time log data

Very sporadically the log data portion of these logs may have a date in it (this is user inputted text) and Splunk pulls the date from the log data in these cases. It causes future dated events that seem like they would be easy to fix, but can't come up with the right props.conf stanza to fix.

Examples:

a2-sb123 App->internal: 2011-12-13 15:23:24,556 INFO  internal  - Incoming Header: subject=FW:A Cool Night Out - Dec. 14, 2011
a2-sb123 App->internal: 2011-12-12 21:28:33,338 INFO  internal  - Incoming Header: subject=FW:December 14, 2011: This is the subject

a2-sb124:2011-12-12 20:50:12,950 INFO  [UI] !!!!! username clicked on saveandnext for agent Dec 14 2011 in SLE
a2-sb124:2011-12-13 03:53:31,689 INFO  UI [ID:wyetdTDrewWE1] - !!!!! username clicked on save for agent 14 Dec 2011 in SLE

Though the logs are dated correctly, Splunk dates the events for December 14th.

I've tried using this in props.conf, but it's not working, maybe it's the use of wildcard? Unfortunately host is the easiest spec to use to get to this data, as the sources and sourcetypes are varied for these servers.

[host::a2-sb*]
TIME_FORMAT = %Y-%m-%d %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 50

Any suggestions?

[tgow · Accepted solution]

The "*" is legal in the host setting in the props.conf. You might try the following in your props.conf

[host::a2-sb*]
TIME_FORMAT = %Y-%m-%d %H:%M:%S
TIME_PREFIX = \w+: