Hockey App logs monitoring

[msn2507]

We are looking to monitor the crash reports from Hockey app. Our enterprise apps are distributed through Hockey app and we are looking to integrate Splunk with Hockey to extract crash report.

Sample log will look like -

{
"crashes":[
{
"model": "iPhone3",
"has_log": true,
"oem": "Apple",
"created_at": "2011-05-02T12:08:10Z",
"updated_at": "2011-05-02T13:01:36Z",
"has_description": false,
"bundle_short_version": "1.0",
"id": 9,
"app_id": 123,
"app_version_id": 456,
"crash_reason_id": 795,
"bundle_version": "92",
"user_string": "",
"os_version": "4.3.2",
"jail_break": false,
"contact_string": ""
},

    ...
],
"total_entries": 72,
"total_pages": 3,
"per_page": 25,
"status": "success",
"current_page": 1

}

{
"crashes": [
{
"model": "iPhone5",
"has_log": true,
"oem": "Apple",
"created_at": "2011-05-02T12:08:10Z",
"updated_at": "2011-05-02T13:01:36Z",
"has_description": false,
"bundle_short_version": "1.0",
"id": 9,
"app_id": 123,
"app_version_id": 456,
"crash_reason_id": 983,
"bundle_version": "90",
"user_string": "",
"os_version": "4.5.2",
"jail_break": false,
"contact_string": ""
},

    ...
],
"total_entries": 72,
"total_pages": 3,
"per_page": 25,
"status": "success",
"current_page": 1

}
{
"crashes": [
{
"model": "iPhone4",
"has_log": true,
"oem": "Apple",
"created_at": "2011-05-02T12:08:10Z",
"updated_at": "2011-05-02T13:01:36Z",
"has_description": false,
"bundle_short_version": "1.0",
"id": 9,
"app_id": 123,
"app_version_id": 456,
"crash_reason_id": 789,
"bundle_version": "89",
"user_string": "",
"os_version": "4.3.2",
"jail_break": false,
"contact_string": ""
},

    ...
],
"total_entries": 72,
"total_pages": 3,
"per_page": 25,
"status": "success",
"current_page": 1

}

any help on how to parse this file is appreciated.

[kristian_kolb]

Looks like JSON to me. There are command for field extraction if that is what you're asking.

See http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath

If you have not yet imported the logs into Splunk, you'll (most likely) need to tweak a few settings regarding how the file is broken into separate events. See the configuration options for LINE_BREAKER, SHOULD_LINEMERGE, TIME_FORMAT, TIME_PREFIX

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf
http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Configurationparametersandthedatapipeline

Hope this helps,

Kristian