The log needs to be plain text.
Each event needs a time stamp.
If that is true you read it in and then create field extracts with regex. You can manually do the regex or let Splunk's GUI create the regex.
I have read in logs that have unusal timestamps
June 11 2015
06:00 some event data
06:12 some event data
06:14 some event data
June 12 2015
00:05 some data
00:15 some data
I have written scripts in powershell and phython that simply reads until the date is found
then read the times and insert the date before the time
write out the newly formated event line to a new file
keep reading until a new date is found.
write new log to disk
splunk reads the new log
I have also used a script output to send the log directly to Splunk. Both are really simple to do.
