Include or clean incorrect timestamps

[atown100]

I have an application log that primarily has timestamps like the following:-

(14.2) 05-12-15 14:28:14 (.....

However sometimes, for certain events, the application misses off the last digit and we get this:-

(14.2) 05-12-15 14:28:1 (....

Obviously, Splunk splits up my events correctly when the timestamp is correct but merges events when the timestamp is wrong.

Is there any way to either;
a) exclude the text lines from the logs where the timestamp is wrong (we can probably live with this) before indexing, or
b) make Splunk use the incorrect timestamps as well, maybe appending a zero (0) onto them

Thanks for any assistance.
b/

[woodcock]

Make this a Heavy Forwarder and repair the events before they are indexed:
http://docs.splunk.com/Documentation/Splunk/5.0.4/Data/Anonymizedatausingconfigurationfiles#Through_...

Your entry should look like this:

[<spec>]
SEDCMD-FixTimestmapBeforeIndexing = s/\(:[0-9]\) /\10 /