I'm trying to find a way to analyse iTunes log files - I'm pretty sure Splunk can help me here, have got some data in but need some help.
My log data look like this, I have 1 log file per day:
ARTIST_ID ITUNES_ID ACTION_TYPE TITLE URL EPISODE_ID EPISODE_TITLE EPISODE_TYPE STOREFRONT USERAGENT IP_ADDRESS TIMESTAMP
402424201 405050927 Browse Psychology http://itunes.apple.com/WebObjects/DZR.woa/wa/viewPodcast?cc=cn&id=405050927 0 143465 iTunes/10.5.2 (Windows; Microsoft Windows XP Professional Service Pack 3 (Build 2600)) AppleWebKit/534.52.7 59.40.x.x 2012-01-19 00:08:29.000-0800
402424201 405050927 Browse Psychology http://itunes.apple.com/WebObjects/DZR.woa/wa/viewPodcast?cc=de&id=405050927 0 143443 iTunes/10.5.2 (Macintosh; Intel Mac OS X 10.6.8) AppleWebKit/534.52.7 77.190.x.x 2012-01-19 00:33:29.000-0800
402424201 420615508 Browse Sociology http://itunes.apple.com/WebObjects/DZR.woa/wa/viewPodcast?cc=us&id=420615508 0 143441 iTunes/10.5.2 (Macintosh; Intel Mac OS X 10.6.8) AppleWebKit/534.52.7 174.117.x.x 2012-01-19 00:36:14.000-0800
402424201 405050927 Stream Psychology http://itunes.apple.com/WebObjects/DZR.woa/wa/viewPodcast?cc=de&id=405050927 89066156 Deal or No Deal, Terrorism and Bicycle Accidents video 143443 iTunes/10.5.2 (Macintosh; Intel Mac OS X 10.6.8) AppleWebKit/534.52.7 77.190.x.x 2012-01-19 00:36:33.000-0800
I have managed to get it to find the correct timestamp using a regexp and saved a source type but when I get it to index other data files from the same directory using the same source type and then view the data in search it's created a separate source type for each new file and not got the correct timestamp or breaks.
Also, how do I deal with the first line of field headings?
Can anyone help or point me to a basic tutorial?
