I have an issue with data I am trying to index. I checked and the files are being monitored but I am still not seeing any data. I guess this has to with the way the data is organized.
For example not every line has a time stamp and the time stamp is not at the beginning of the line.
rum.rndcsalesforce.com - - [28/Nov/2016 07:28:03] "GET / HTTP/1.1" 200 - LOG: -ZOMBIE: PkTaskMgmtS (exitcode:-11) pid:29053 status:starting cleanup factories: ['TaskMgmtIFFactory:29053'] LOG: STARTED PkTaskMgmtS (#1) pid:27319 status:starting -QUEUED: PkTaskMgmtS #Listeners:1 Started Factory TaskMgmtIFFactory via program PkTaskMgmtS CLS Assertion failed: rc == 0, File /opt/manhattan64/coreservices/cls/5.0.11.rhel564/include/ClsLock.hpp, Line 578, TID 47196679497472, PID 22144
How would I go ahead and make my sourcetype to index this kinda data?
my suggest is to put an extraction of your logs in a text file and use the web guided function to add data.
In this way you can build your sourcetype and immediately verify if the timestamp is correctly acquired or not.
Thank you, I did this but it was still was indexing. Turns out the problem was on a different end:
File will not be read, seekptr checksum did not match. Last time we saw this initcrc, filename was different. You may wish to use a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info.
Once I added crcSalt to the index.conf, the files were being indexed