Think the "," delimiting the fraction of a second is causing the problem? Not sure why Splunk would trip on that. You could try what gkanapathy suggested for a more extreme case (http://splunk-base.splunk.com/answers/6413/timestamp-problem-propsconf), but changed to the following.
<datetime>
<define name="_mydatetimeformat" extract="year, month, day, hour, minute, second">
<text><![CDATA[^.*(20[\d]{2})\-(0[1-9]|1[0-2])\-([0-3][0-9])\s+([01][0-9]|2[0-4]):([0-5][0-9]):([0-5][0-9])]]></text>
</define>
<timePatterns>
<use name="_mydatetimeformat"/>
</timePatterns>
<datePatterns>
<use name="_mydatetimeformat"/>
</datePatterns>
</datetime>
Where your props.conf will look something like:
[log4j]
DATETIME_CONFIG = /etc/apps/myapp/local/mycustomdatetime.xml
TZ = Australia/Adelaide
...or...
You can try specifying the a valid time format using TIME_FORMAT. I don't know if my example will work or not.
[log4j]
TIME_PREFIX = <regex to match up to date | ommit if date/time is a front of event>
TIME_FORMAT = %Y-%m-%d %T
TZ = Australia/Adelaide
A Google search for strptime resolved this site among others (http://pubs.opengroup.org/onlinepubs/007904975/functions/strptime.html)
...or...
Change the log4j's configuraton to not use the comma to delimit the sub-second.
... View more