You can solve this by specifying the time format Splunk should be looking for in props.conf. Right now in your installation Splunk breaks out a new event whenever it sees something that can be interpreted as a timestamp (which is the default behaviour), so by explicitly telling Splunk what the timestamp looks like it will only look for timestamps in that format.
Something like this should go into your props.conf (like $SPLUNK_HOME/etc/system/local/props.conf):
TIME_FORMAT = %d %b %Y %T
...where you should exchange yoursourcetype for the actual name of the sourcetype you're using for these logs. This will match "17 Jun 2011 13:59:13" but not "2011-06-17 13:59:13.685 EST", so Splunk will not break the event.