Getting Data In

trouble getting started

mikehughes
New Member

I'm trying to find a way to analyse iTunes log files - I'm pretty sure Splunk can help me here, have got some data in but need some help.

My log data look like this, I have 1 log file per day:

ARTIST_ID   ITUNES_ID   ACTION_TYPE TITLE   URL EPISODE_ID  EPISODE_TITLE   EPISODE_TYPE    STOREFRONT  USERAGENT   IP_ADDRESS  TIMESTAMP
402424201   405050927   Browse  Psychology  http://itunes.apple.com/WebObjects/DZR.woa/wa/viewPodcast?cc=cn&id=405050927    0           143465  iTunes/10.5.2 (Windows; Microsoft Windows XP Professional Service Pack 3 (Build 2600)) AppleWebKit/534.52.7 59.40.x.x   2012-01-19 00:08:29.000-0800
402424201   405050927   Browse  Psychology  http://itunes.apple.com/WebObjects/DZR.woa/wa/viewPodcast?cc=de&id=405050927    0           143443  iTunes/10.5.2 (Macintosh; Intel Mac OS X 10.6.8) AppleWebKit/534.52.7   77.190.x.x  2012-01-19 00:33:29.000-0800
402424201   420615508   Browse  Sociology   http://itunes.apple.com/WebObjects/DZR.woa/wa/viewPodcast?cc=us&id=420615508    0           143441  iTunes/10.5.2 (Macintosh; Intel Mac OS X 10.6.8) AppleWebKit/534.52.7   174.117.x.x 2012-01-19 00:36:14.000-0800
402424201   405050927   Stream  Psychology  http://itunes.apple.com/WebObjects/DZR.woa/wa/viewPodcast?cc=de&id=405050927    89066156    Deal or No Deal, Terrorism and Bicycle Accidents    video   143443  iTunes/10.5.2 (Macintosh; Intel Mac OS X 10.6.8) AppleWebKit/534.52.7   77.190.x.x  2012-01-19 00:36:33.000-0800

I have managed to get it to find the correct timestamp using a regexp and saved a source type but when I get it to index other data files from the same directory using the same source type and then view the data in search it's created a separate source type for each new file and not got the correct timestamp or breaks.

Also, how do I deal with the first line of field headings?

Can anyone help or point me to a basic tutorial?

0 Karma

yannK
Splunk Employee
Splunk Employee

Define a sourcetype in the props.conf, apply this sourcetype in inputs.conf
then you can pick automatic header detection, or define a fix name for the fields.

see http://docs.splunk.com/Documentation/Splunk/4.3.1/Data/Extractfieldsfromfileheadersatindextime

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...