no idea where to start

[leadmagnet]

Just installed splunk and have it indexing several servers event logs. Nifty! 😉

Thought it would be nice to have it chew on my servers VPN logs. I have the CSV definition from MS (here) and splunk can get to the files.

However, it stops on the first record, first file as it cannot parse the file correctly.

How do I get it to go!?

[yannK]

You may have to define a special parsing,
Take a sample and index it using an upload on a test index using the preview.
http://docs.splunk.com/Documentation/Splunk/latest/Data/Overviewofdatapreview

[leadmagnet]

Thanks for that, but I already tried this. The data is imported as a single line. The CSV definition does nto appear in the "interesting fields" list, because I haven't told it which comma seperated column is called what and what type of data it contains. To get even more complex, some of these fields (ref the previous link) need to "lookup" their actual value.

Still stumpped!

:S