How to index data where the timestamp is not on every line or at the the beginning of a line?

[omuelle1]

Hi,

I have an issue with data I am trying to index. I checked and the files are being monitored but I am still not seeing any data. I guess this has to with the way the data is organized.

For example not every line has a time stamp and the time stamp is not at the beginning of the line.

rum.rndcsalesforce.com - - [28/Nov/2016 07:28:03] "GET / HTTP/1.1" 200 -
LOG: -ZOMBIE: PkTaskMgmtS (exitcode:-11) pid:29053 status:starting
cleanup factories: ['TaskMgmtIFFactory:29053']

LOG: STARTED PkTaskMgmtS (#1) pid:27319 status:starting
-QUEUED: PkTaskMgmtS #Listeners:1
Started Factory TaskMgmtIFFactory via program PkTaskMgmtS
CLS Assertion failed: rc == 0, File /opt/manhattan64/coreservices/cls/5.0.11.rhel564/include/ClsLock.hpp, Line 578, TID 47196679497472, PID 22144

How would I go ahead and make my sourcetype to index this kinda data?

Thank you,

Oliver

[gcusello · Accepted solution]

Hi omuelle1,
my suggest is to put an extraction of your logs in a text file and use the web guided function to add data.
In this way you can build your sourcetype and immediately verify if the timestamp is correctly acquired or not.
Bye.
Giuseppe

[omuelle1]

Thank you, I did this but it was still was indexing. Turns out the problem was on a different end:

File will not be read, seekptr checksum did not match. Last time we saw this initcrc, filename was different.  You may wish to use a CRC salt on this source.  Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info.

Once I added crcSalt to the index.conf, the files were being indexed