Getting Data In

trouble getting started

mikehughes
New Member

I'm trying to find a way to analyse iTunes log files - I'm pretty sure Splunk can help me here, have got some data in but need some help.

My log data look like this, I have 1 log file per day:

ARTIST_ID   ITUNES_ID   ACTION_TYPE TITLE   URL EPISODE_ID  EPISODE_TITLE   EPISODE_TYPE    STOREFRONT  USERAGENT   IP_ADDRESS  TIMESTAMP
402424201   405050927   Browse  Psychology  http://itunes.apple.com/WebObjects/DZR.woa/wa/viewPodcast?cc=cn&id=405050927    0           143465  iTunes/10.5.2 (Windows; Microsoft Windows XP Professional Service Pack 3 (Build 2600)) AppleWebKit/534.52.7 59.40.x.x   2012-01-19 00:08:29.000-0800
402424201   405050927   Browse  Psychology  http://itunes.apple.com/WebObjects/DZR.woa/wa/viewPodcast?cc=de&id=405050927    0           143443  iTunes/10.5.2 (Macintosh; Intel Mac OS X 10.6.8) AppleWebKit/534.52.7   77.190.x.x  2012-01-19 00:33:29.000-0800
402424201   420615508   Browse  Sociology   http://itunes.apple.com/WebObjects/DZR.woa/wa/viewPodcast?cc=us&id=420615508    0           143441  iTunes/10.5.2 (Macintosh; Intel Mac OS X 10.6.8) AppleWebKit/534.52.7   174.117.x.x 2012-01-19 00:36:14.000-0800
402424201   405050927   Stream  Psychology  http://itunes.apple.com/WebObjects/DZR.woa/wa/viewPodcast?cc=de&id=405050927    89066156    Deal or No Deal, Terrorism and Bicycle Accidents    video   143443  iTunes/10.5.2 (Macintosh; Intel Mac OS X 10.6.8) AppleWebKit/534.52.7   77.190.x.x  2012-01-19 00:36:33.000-0800

I have managed to get it to find the correct timestamp using a regexp and saved a source type but when I get it to index other data files from the same directory using the same source type and then view the data in search it's created a separate source type for each new file and not got the correct timestamp or breaks.

Also, how do I deal with the first line of field headings?

Can anyone help or point me to a basic tutorial?

0 Karma

yannK
Splunk Employee
Splunk Employee

Define a sourcetype in the props.conf, apply this sourcetype in inputs.conf
then you can pick automatic header detection, or define a fix name for the fields.

see http://docs.splunk.com/Documentation/Splunk/4.3.1/Data/Extractfieldsfromfileheadersatindextime

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...