iOS Crash logs - Indexing

[sreeram_thinkal]

Hi,

Newbie to Splunk and trying to use Splunk to arrive at a trend of the iOS Crashes which have been collected for the app. My Crashes have been symbolicated and would like to understand how can i set the parameters/index in the inputs/props.conf file so that we can arrive at meaningful stats and decide which are the crashes that need attention.

I was seeing that the log was getting split into 3 events. Any thoughts on how we can get each log to report as a single event. Any help is much appreciated. Thanks in advance

Sample Blob of the Crash log.

Incident Identifier: 8E5DB983-85A2-4EB9-9B0D-E2E7E5BA1186

CrashReporter Key: 2313bfd421266d4ac33fe70b900ab6415cdf8032

Hardware Model: iPhone5,1

Process: Myapp [333]

Path: /var/mobile/Applications/29C203D7-4D14-4DFE-B321-6F00BFF918FF/Myapp.app/Myapp

Identifier: MyApp

Version: ??? (???)

Code Type: ARM (Native)

Parent Process: launchd [1]

Date/Time: 2013-06-04 11:06:45.378 -0700

OS Version: iOS 6.1.4 (10B350)

Report Version: 104

Exception Type: EXC_CRASH (SIGTRAP)

Exception Codes: 0x0000000000000000, 0x0000000000000000

Crashed Thread: 1

Thread 0 name: Dispatch queue: com.apple.main-thread

Thread 0:

0 CoreFoundation 0x3328c68a CFRelease + 18

1 WebCore 0x39299cdc WebCore::stopSharedTimer() + 24

2 WebCore 0x392ee9e8 WebCore::TimerBase::~TimerBase() + 40

3 WebCore 0x3931ad46 WebCore::Document::~Document() + 2746

4 WebCore 0x3931a27c WebCore::HTMLDocument::~HTMLDocument() + 76

5 WebCore 0x393a330c
WebCore::JSNodeOwner::finalize(JSC::HandleJSC::Unknown, void*) + 76

6 JavaScriptCore 0x37373f12 JSC::WeakBlock::sweep() + 86

7 JavaScriptCore 0x37374154 JSC::WeakSet::sweep() + 48

8 JavaScriptCore 0x372cedc2 JSC::Heap::collect(JSC::Heap::SweepToggle) + 170

9 JavaScriptCore 0x372ce00c JSC::DefaultGCActivityCallbackPlatformData::timerDidFire(__CFRunLoopTimer*, void*) + 140

10 CoreFoundation 0x33320854 CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION + 12

11 CoreFoundation 0x333204fe __CFRunLoopDoTimer + 270

12 CoreFoundation 0x3331f172 __CFRunLoopRun + 1226

13 CoreFoundation 0x33292238 CFRunLoopRunSpecific + 352

14 CoreFoundation 0x332920c4 CFRunLoopRunInMode + 100

15 GraphicsServices 0x36e71336 GSEventRunModal + 70

16 UIKit 0x351ae2b4 UIApplicationMain + 1116

17 Myapp 0x00062192 main (main.m:12)

18 Myapp 0x00062174 start + 36

[starcher]

This is down and dirty. I just tossed your sample into the preview in splunk for adding a new source and played with it.

Put this under your sourcetype definition in props.conf.
BREAK_ONLY_BEFORE=Incident Identifier:
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=true
TIME_PREFIX=Date/Time: