Hi, Want to extract timestamp for below log using props.conf . Any Suggestion

[shinde0509]

2017-04-02 so-splunky.local 22:45:19.023 -0600 sshd[68061]: Accepted keyboard-interactive/pam for sowings from xx.xx.xx.xx port xx ssh2
2017-04-02 so-splunky.local 23:45:23.142 -0500 sshd[68608]: Accepted keyboard-interactive/pam for sowings from xx.xx.xx.xx port 36477 ssh2

[somesoni2]

Here is what I would use (Assming timeformat is YYYY-MM-DD, swap MM-DD in TIME_FORMAT if different)

props.conf on Heavy forwarder/Indexer (whichever comes first in the flow)

[yoursourcetypehere]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)(?=\d{4}-\d{2}-\d{2}\s\w+)
TIME_PREFIX = ^
TIME_FORMAT = %Y-%m-%d so-splunky.local %H:%M:%S:%N %Z
MAX_TIMESTAMP_LOOKAHEAD = 46