Getting Data In

trouble getting started

mikehughes
New Member

I'm trying to find a way to analyse iTunes log files - I'm pretty sure Splunk can help me here, have got some data in but need some help.

My log data look like this, I have 1 log file per day:

ARTIST_ID   ITUNES_ID   ACTION_TYPE TITLE   URL EPISODE_ID  EPISODE_TITLE   EPISODE_TYPE    STOREFRONT  USERAGENT   IP_ADDRESS  TIMESTAMP
402424201   405050927   Browse  Psychology  http://itunes.apple.com/WebObjects/DZR.woa/wa/viewPodcast?cc=cn&id=405050927    0           143465  iTunes/10.5.2 (Windows; Microsoft Windows XP Professional Service Pack 3 (Build 2600)) AppleWebKit/534.52.7 59.40.x.x   2012-01-19 00:08:29.000-0800
402424201   405050927   Browse  Psychology  http://itunes.apple.com/WebObjects/DZR.woa/wa/viewPodcast?cc=de&id=405050927    0           143443  iTunes/10.5.2 (Macintosh; Intel Mac OS X 10.6.8) AppleWebKit/534.52.7   77.190.x.x  2012-01-19 00:33:29.000-0800
402424201   420615508   Browse  Sociology   http://itunes.apple.com/WebObjects/DZR.woa/wa/viewPodcast?cc=us&id=420615508    0           143441  iTunes/10.5.2 (Macintosh; Intel Mac OS X 10.6.8) AppleWebKit/534.52.7   174.117.x.x 2012-01-19 00:36:14.000-0800
402424201   405050927   Stream  Psychology  http://itunes.apple.com/WebObjects/DZR.woa/wa/viewPodcast?cc=de&id=405050927    89066156    Deal or No Deal, Terrorism and Bicycle Accidents    video   143443  iTunes/10.5.2 (Macintosh; Intel Mac OS X 10.6.8) AppleWebKit/534.52.7   77.190.x.x  2012-01-19 00:36:33.000-0800

I have managed to get it to find the correct timestamp using a regexp and saved a source type but when I get it to index other data files from the same directory using the same source type and then view the data in search it's created a separate source type for each new file and not got the correct timestamp or breaks.

Also, how do I deal with the first line of field headings?

Can anyone help or point me to a basic tutorial?

0 Karma

yannK
Splunk Employee
Splunk Employee

Define a sourcetype in the props.conf, apply this sourcetype in inputs.conf
then you can pick automatic header detection, or define a fix name for the fields.

see http://docs.splunk.com/Documentation/Splunk/4.3.1/Data/Extractfieldsfromfileheadersatindextime

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.