_time field extraction

[kulo]

I found that the _time field in my event was a bit unusual

19756;10;7;mik;security;2017-08-04 10:57:33;test（20170731-20170804）.xlsx;;1;0;et.exe;;

The _time field for this time is shown as follows: 17/08/04 20: 17: 08.040, accurate should be based on the event "2017-08-04 10:57:33" _time is 17/08/04 10: 57: 33.040.
I think the splunk matches the test in the event (20170731-20170804) .xlsx and then comes the _time, how do i let _time read the fifth; the number with the sixth; the date between the date

[gcusello]

try using

TIME_PREFIX = ([^;];){5}
TIME_FORMAT = %Y-%m-%d %H:%M:%S

Bye.
Giuseppe

[adonio]

fix it with props.conf
explanation here, read all the way through the page
http://docs.splunk.com/Documentation/Splunk/6.6.2/Data/HowSplunkextractstimestamps
hope it helps