Why am I unable to import a simple log file into Splunk?

[thorntonrose]

I am trying to import a simple log file into Splunk. It seems to me that it should be easy, but it's not working. My log file looks like this:

2015-03-25T06:31:09.351320+00:00 nst-ms-m-mmp-dev-ui-01 process_manager[2462]: Starting up
2015-03-25T06:31:10.109330+00:00 nst-ms-m-mmp-dev-ui-01 monaco process_manager debug (periodic_task:start_task:138): Starting task pt_logging_periodic_check
2015-03-25T06:31:10.245144+00:00 nst-ms-m-mmp-dev-ui-01 monaco process_manager info Starting erlang component with PID 2462.
2015-03-25T06:31:10.245351+00:00 nst-ms-m-mmp-dev-ui-01 monaco process_manager debug (periodic_task:start_task:138): Starting task pt_force_garbage_collector
...

When I import the files, I preview as "Unstructured data", set the line breaking to one event per line, and set the timestamp format to %Y-%m-%dT%H:%M:%S.%6N%z.

I get no results. What am I missing?

[jmheaton]

Try not setting the timestamp format and line breaking to see if the data appears.
Then add configurations one at a time until you find the broken one/

James

[ChrisG]

Are you saying the events don't show up in data preview, or that they do show up in data preview but then you can't get search results? It would help if you explained the steps you took to import the file. If you have passed the data preview stage and can't find the events when you search, there are a couple of things you can look at:

• Does the time range of your search cover the same period as the events? Search over all time to make sure.
• Do you have permissions to search the index where the data is?
• Is the data in the same index you're searching?

[thorntonrose]

The events don't show up in the data preview. To import the file, I clicked on Add Data, selected the file, entered the line breaking and timestamp criteria, then clicked Apply.