props.conf TIME_FORMAT for middle of the line DATETIME

[splunk_zen]

I'm having trouble recognizing the timestamp for a logs with this structure,
(field timestamp appears = none in Splunk fields column)

DEBUG [org.springframework.scheduling.quartz.SchedulerFactoryBean#0_Worker-3] 09 Dec 2014 22:00:03,760 (?:?) - Performing a clean update ...
DEBUG [org.springframework.scheduling.quartz.SchedulerFactoryBean#0_Worker-3] 09 Dec 2014 22:00:03,761 (?:?) - Delete Query: delete bla_bla
 INFO [org.springframework.scheduling.quartz.SchedulerFactoryBean#0_Worker-3] 09 Dec 2014 22:00:03,797 (?:?) - Records processed - total: 9, inserted: 9, skipped: 0
DEBUG [org.springframework.scheduling.quartz.SchedulerFactoryBean#0_Worker-3] 09 Dec 2014 22:00:03,808 (?:?) -

My props.conf

[spring_output]
NO_BINARY_CHECK=1
SHOULD_LINEMERGE = true
TIME_FORMAT = %d %b %Y %H:%M:%S,%3N
# Breaking events on lines like:  "DEBUG [org.springframework.scheduling.quartz.SchedulerFactoryBean#0_Worker:3] 09 Dec 2014 22:00:03,949"
TIME_PREFIX = ^\s*([A-Z])\w+ \[.*]\s+
MAX_TIMESTAMP_LOOKAHEAD=1
TZ=EST
BREAK_ONLY_BEFORE=^FATAL|^DEBUG|^ERROR|^INFO|^TRACE|^WARN|^ WARN|^ INFO|^CRIT|^ CRIT
MAX_EVENTS = 99999
TRUNCATE = 0

[splunk_zen · Accepted solution]

Really unsure why Splunk was choking on this but rebuilding it from anew has it now working as expected.

cat local/props.conf
[spring_output]
BREAK_ONLY_BEFORE = ^FATAL|^DEBUG|^ERROR|^INFO|^TRACE|^WARN|^ WARN|^ INFO|^CRIT|^ CRIT
MAX_TIMESTAMP_LOOKAHEAD = 1
NO_BINARY_CHECK = 1
TIME_FORMAT = %d %b %Y %H:%M:%S,%3N
TIME_PREFIX = ^\s*([A-Z])\w+ \[.*]\s+
TZ = EST
pulldown_type = 1

[splunk_zen]

Thanks somesoni2,
could have omitted that as it's only meant to speed up the indexing after I get the timestamp recognition working.
Unfortunately removing it still results in Splunk recognising 0 timestamps.

[somesoni2]

Just get rid of this

AX_TIMESTAMP_LOOKAHEAD=1