Your TIME_FORMAT looks good, however your MAX_TIMESTAMP_LOOKAHEAD doesn't. MAX_TIMESTAMP_LOOKAHEAD defines how many characters relative to (optional) TIME_PREFIX it should use for timestamp extraction, not how many characters relative to TIME_PREFIX before it should start looking. From the docs:
MAX_TIMESTAMP_LOOKAHEAD = <integer>
* Specifies how far (in characters) into an event Splunk should look for a timestamp.
* This constraint to timestamp extraction is applied from the point of the TIME_PREFIX-set location.
* For example, if TIME_PREFIX positions a location 11 characters into the event, and MAX_TIMESTAMP_LOOKAHEAD is set to 10, timestamp extraction will be constrained to characters 11 through 20.
http://docs.splunk.com/Documentation/Splunk/4.3/admin/Propsconf
... View more