What separates your data fields? Is this a csv file, or is there another common break you have to break the fields apart? If it is a csv, we have found that we must add a [^,] to the end of the timefield extraction. Also, if you are using the web interface then try using a regex to define where your event breaks should occur. Again, we use csv a lot and use the following regex to help define these when we do custom timestamp extraction:
(?i)^(("(?:[^"]|"")"|[^,]),){2}
At least in our environment this has helped.
... View more