You can also make use of Kepware's UCON driver to create a custom interface. After which forward that data to the Splunk instance via the IDF in real time. In that way, there will be no need to store any data in your server since all of them are properly indexed inside Splunk itself. This also gives you the added benefit of displaying the data in real time on a dashboard.
Alternatively, you can also load up the Modbus library on your Arudino, assign the values to the correct registers and communicate with Kepware as the Modbus Master. That way, you can avoid developing the UCON driver and just grab the off the shelf Modbus drivers.
Link for Modbus library: https://code.google.com/p/simple-modbus/
Thanks all for your answers
These sensors send these kind of messages always with "time", it's a live data flow, and we'll store all these infos in our server.
How is the data getting logged? Remember that Splunk can handle any source of data.
Can you provide a full log entry? Is time anywhere in the event?
Splunk stores all of the data on the back-end by time.
If this is a typical entry then you will probably have to setup some of the following options in the props.conf:
[yoursourcetype]
SHOULD_LINEMERGE = True
BREAK_ONLY_BEFORE = ^Rain
Yes. If it's text, Splunk will happily index it. You will have to handle getting the data from the sensors and building the alerts etc, but it's definitely most possible.