Multiple Timestamps

I you didn't have a TIME_PREFIX I think you would be ok (because you have %b in your time format, splunk shouldn't match your first date timestamp because it doesn't have a day of the week shown). That said, I using TIME_PREFIX is better.

I see a couple minor but potentially problem-causing issues with your current config:

1. I don't think the sourcetype:: prefix is allowed, as suggested by Siegfried.
2. Your TIME_PREFIX doesn't allow for a trailing space between the host name and the date that you want to use.
3. The TIME_PREFIX doesn't allow for a single-digit day (I'm assuming this is a syslog file, in which case the standard format for July 4 would be "Jul__4 2010" (had to use an underscore to get the formatting to show up on this site.) Your current regex only allows for a single space.
4. I recommend using a ^ (start of line) in your TIME_PREFIX to let the regex engine do less work.

Here is what I would suggest you put in your props.conf file:

[dns_data]
TIME_PREFIX = ^\w+ .\d \d\d:\d\d:\d\d \S+\s+
TIME_FORMAT = %b %d %H:%M:%S %Y

If you want, you can also use a SEDCMD entry to drop that first date out of there entirely so you consume less bytes in your index. I have some log sources that do this and it makes it easily to review the logs when there aren't two sets of dates for your eyes to scan over.

 SEDCMD-drop_extra_date = s/^\w+ .\d \d\d:\d\d:\d\d (.*)$/\1/

Keep in mind the timestamp extraction happens first, so you don't have to worry about your SEDCMD getting in the way of your TIME_PREFIX.

You could also move the second date (the one your are keeping) to the front if you want to. (To be more consitent with your other syslog mesages.

 SEDCMD-use_2nd_date = s/^\w+ .\d \d\d:\d\d:\d\d (\S+) (\w+ \w+ .\d \d\d:\d\d:\d\d \d{4})(.*)$/\2 \1 \3/

(I haven't tested these SEDCMD expressions, so they may not work right away. They are mostly just to give you and idea of what you can do.)

Still not working huh? Here are a few more things to double check:

1. Verify that your sourcetype is actually dns_data on your indexed events and not syslog or something like that. (You aren't using any sourcetype renaming transformers are you? If you don't know what I'm talking about then you probably are not.)
2. Make sure your putting your changes in the correct file. Should be $SPLUNK_HOME/etc/system/local/props.conf (You noted "sys" instead of "system" in your original question, but I'm assuming that was just a shortcut notation which I get, but splunk would not.)

See this link for more props debugging techniques