All, Here is the file name and my datetime.xml config. When I apply this and try to import the data, Splunk gets stuck in preview and never shows the data. Thanks in advance for the assist! File Name: ADESS_FANALL_01082014_01172014_195441.csv Datetime.xml Config <datetime> <define name="_masheddate3" extract="month, day, year"> <text><![CDATA[(?:^|source::|source:).*?ADESS_FANALL_([01]\d)([0123]\d)(20[01]\d)]]></text> </define> <datePatterns> <use name="_masheddate3"/> </datePatterns> </datetime> ... View more

Below is my sample log. I'm trying to extract all the 'Pend Reason' codes and still maintain the host field which I'm extracting from the appserver line at the top. I've tried numerous combos but can't make it work. Please help! Please ignore the extra font formatting in the example. The TriZetto Group, Inc cerbnav0 Batch Router Module Version 5.01.00.9 Mar 11 2012 08:46:31 Copyright © 1997-2011 The TriZetto Group, Inc. All rights reserved. Application Server: MLTTSAPV164 Process ID : 5932 User : svcFAPTst *-- Standard Error --* ================================ Initialization Phase Started. Actual Run Start Date and Time [11/26/2012 10:12:46.959] Initialization Phase Complete. ================================ ================================ Execution Phase Started. The TriZetto Group, Inc cmcbclmu Claims Multi-Eng Electronic Adjud. Program Version 5.01.00.5 Apr 30 2012 16:36:32 Copyright © 1997-2011 The TriZetto Group, Inc. All rights reserved. Application Server: MLTTSAPV165 Process ID : 5932 User : svcFAPTst *-- Standard Error --* ================================ Initialization Phase Started. Actual Run Start Date and Time [11/26/2012 10:12:46.959] Initialization Phase Complete. ================================ ================================ Execution Phase Started. Facets - Error: 11/26/2012 10:12:49.284 Return Code: 8 Error Code: 51301 Error Message: 823815090500 Pended due to Security Violation. Warning Message limit exceeds User limit Warn Number = 56 Warning Text = 0056-HOLD ALL CLAIMS FOR THIS PROVIDER Pend Reason = XC01 WMWM Solution: Facets - Error: 11/26/2012 10:12:49.284 Return Code: 8 Error Code: 51301 Error Message: 823815090500 Pended due to Security Violation. Warning Message limit exceeds User limit Warn Number = 550 Warning Text = PRPR-0046: PEND CLAIM TO PV03 Pend Reason = XC01 WMWM Solution: Facets - Error: 11/26/2012 10:12:53.487 Return Code: 8 Error Code: 51301 Error Message: 823796580000 Pended due to Security Violation. Warning Message limit exceeds User limit Warn Number = 570 Warning Text = IPCD-0013: RMN CODE (line 1) Pend Reason = CE08 WMUD Solution: ================================ Termination Phase Started. Actual Run End Date and Time [11/26/2012 10:13:31.959] Termination Phase Complete. The Highest return code is: 0 ================================ Execution Phase Complete. ================================ ================================ Termination Phase Started. Actual Run End Date and Time [11/26/2012 10:13:32.287] Termination Phase Complete. The Highest return code is: 0 ================================ ... View more