https://community.splunk.com/t5/Getting-Data-In/trouble-getting-started/m-p/30847#M5427 <P>Define a sourcetype in the props.conf, apply this sourcetype in inputs.conf<BR /> then you can pick automatic header detection, or define a fix name for the fields.</P> <P>see <A href="http://docs.splunk.com/Documentation/Splunk/4.3.1/Data/Extractfieldsfromfileheadersatindextime">http://docs.splunk.com/Documentation/Splunk/4.3.1/Data/Extractfieldsfromfileheadersatindextime</A> </P> Thu, 19 Apr 2012 12:41:08 GMT yannK 2012-04-19T12:41:08Z https://community.splunk.com/t5/Getting-Data-In/trouble-getting-started/m-p/30846#M5426 <P>I'm trying to find a way to analyse iTunes log files - I'm pretty sure Splunk can help me here, have got some data in but need some help.</P> <P>My log data look like this, I have 1 log file per day:</P> <PRE><CODE>ARTIST_ID ITUNES_ID ACTION_TYPE TITLE URL EPISODE_ID EPISODE_TITLE EPISODE_TYPE STOREFRONT USERAGENT IP_ADDRESS TIMESTAMP 402424201 405050927 Browse Psychology <A href="http://itunes.apple.com/WebObjects/DZR.woa/wa/viewPodcast?cc=cn&amp;id=405050927" target="test_blank">http://itunes.apple.com/WebObjects/DZR.woa/wa/viewPodcast?cc=cn&amp;id=405050927</A> 0 143465 iTunes/10.5.2 (Windows; Microsoft Windows XP Professional Service Pack 3 (Build 2600)) AppleWebKit/534.52.7 59.40.x.x 2012-01-19 00:08:29.000-0800 402424201 405050927 Browse Psychology <A href="http://itunes.apple.com/WebObjects/DZR.woa/wa/viewPodcast?cc=de&amp;id=405050927" target="test_blank">http://itunes.apple.com/WebObjects/DZR.woa/wa/viewPodcast?cc=de&amp;id=405050927</A> 0 143443 iTunes/10.5.2 (Macintosh; Intel Mac OS X 10.6.8) AppleWebKit/534.52.7 77.190.x.x 2012-01-19 00:33:29.000-0800 402424201 420615508 Browse Sociology <A href="http://itunes.apple.com/WebObjects/DZR.woa/wa/viewPodcast?cc=us&amp;id=420615508" target="test_blank">http://itunes.apple.com/WebObjects/DZR.woa/wa/viewPodcast?cc=us&amp;id=420615508</A> 0 143441 iTunes/10.5.2 (Macintosh; Intel Mac OS X 10.6.8) AppleWebKit/534.52.7 174.117.x.x 2012-01-19 00:36:14.000-0800 402424201 405050927 Stream Psychology <A href="http://itunes.apple.com/WebObjects/DZR.woa/wa/viewPodcast?cc=de&amp;id=405050927" target="test_blank">http://itunes.apple.com/WebObjects/DZR.woa/wa/viewPodcast?cc=de&amp;id=405050927</A> 89066156 Deal or No Deal, Terrorism and Bicycle Accidents video 143443 iTunes/10.5.2 (Macintosh; Intel Mac OS X 10.6.8) AppleWebKit/534.52.7 77.190.x.x 2012-01-19 00:36:33.000-0800 </CODE></PRE> <P>I have managed to get it to find the correct timestamp using a regexp and saved a source type but when I get it to index other data files from the same directory using the same source type and then view the data in search it's created a separate source type for each new file and not got the correct timestamp or breaks.</P> <P>Also, how do I deal with the first line of field headings?</P> <P>Can anyone help or point me to a basic tutorial?</P> Thu, 19 Apr 2012 11:20:32 GMT https://community.splunk.com/t5/Getting-Data-In/trouble-getting-started/m-p/30846#M5426 mikehughes 2012-04-19T11:20:32Z https://community.splunk.com/t5/Getting-Data-In/trouble-getting-started/m-p/30847#M5427 <P>Define a sourcetype in the props.conf, apply this sourcetype in inputs.conf<BR /> then you can pick automatic header detection, or define a fix name for the fields.</P> <P>see <A href="http://docs.splunk.com/Documentation/Splunk/4.3.1/Data/Extractfieldsfromfileheadersatindextime">http://docs.splunk.com/Documentation/Splunk/4.3.1/Data/Extractfieldsfromfileheadersatindextime</A> </P> Thu, 19 Apr 2012 12:41:08 GMT https://community.splunk.com/t5/Getting-Data-In/trouble-getting-started/m-p/30847#M5427 yannK 2012-04-19T12:41:08Z