Parsing time failing

Hi. I have done a good amount of reading on this, and it seems to be a popular subject both in the documentation and on the Answers site. Still, I'm rather stumped.

We have logs where each line starts with a date/time stamp in the format

YYYYmmdd HHMMSS hostname lots of other data

So

20110711 145022 myhost yadda yadda yadda

Splunk combines as many of these lines into one event as it can. We have tried adding the following to Props.conf on the Indexers but have had no success.

TIME_FORMAT = %Y%m%d %H%M%S
TZ = US/Eastern
MAX_EVENTS=1
SHOULD_LINEMERGE = false

Also tried TIME_FORMAT = ^%Y%m%d %H%M%S

Is this likely just a regex problem?

Other elements of the props.conf stanza are honored and acted upon when the data is indexed.

Given the simplicity of the timestamp and its presence at the very beginning of the line, I would think this would be easy to solve. Do we need to look at a custom datetime.xml file?

Thanks for any guidance.