Getting Data In

How to index data where the timestamp is not on every line or at the the beginning of a line?

omuelle1
Communicator

Hi,

I have an issue with data I am trying to index. I checked and the files are being monitored but I am still not seeing any data. I guess this has to with the way the data is organized.

For example not every line has a time stamp and the time stamp is not at the beginning of the line.

rum.rndcsalesforce.com - - [28/Nov/2016 07:28:03] "GET / HTTP/1.1" 200 -
LOG: -ZOMBIE: PkTaskMgmtS (exitcode:-11) pid:29053 status:starting
cleanup factories: ['TaskMgmtIFFactory:29053']

LOG: STARTED PkTaskMgmtS (#1) pid:27319 status:starting
-QUEUED: PkTaskMgmtS #Listeners:1
Started Factory TaskMgmtIFFactory via program PkTaskMgmtS
CLS Assertion failed: rc == 0, File /opt/manhattan64/coreservices/cls/5.0.11.rhel564/include/ClsLock.hpp, Line 578, TID 47196679497472, PID 22144

How would I go ahead and make my sourcetype to index this kinda data?

Thank you,

Oliver

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi omuelle1,
my suggest is to put an extraction of your logs in a text file and use the web guided function to add data.
In this way you can build your sourcetype and immediately verify if the timestamp is correctly acquired or not.
Bye.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi omuelle1,
my suggest is to put an extraction of your logs in a text file and use the web guided function to add data.
In this way you can build your sourcetype and immediately verify if the timestamp is correctly acquired or not.
Bye.
Giuseppe

omuelle1
Communicator

Thank you, I did this but it was still was indexing. Turns out the problem was on a different end:

File will not be read, seekptr checksum did not match. Last time we saw this initcrc, filename was different.  You may wish to use a CRC salt on this source.  Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info.

Once I added crcSalt to the index.conf, the files were being indexed

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...