We have an application that does NOT generate it's own logs. We are in a position where we can get the logs generated on the fly to be able to do a report showing a timeline based on logs from 4 systems.
The applications owner can generate the logs in almost any format we want. I had him generate a log with the format:
FIELD1="VALUE1" FIELD2="VALUE2"
Where field 1 happens to be the event time and field 2 happens to be username. I added OR FIELD2=VALUE to my search and added the fields for FIELD1 and FIELD2 to my | table.
I have two problems. I assume the second is a result of the first. When I look at that file only in splunk it shows me the events and it seems to extract the fields, however when I do a search it does not. The other issue is that it doens't appear to be viewing FIELD1 as the even date and time.. it's just another field with some data in it.
The application can give me CSV or TXT files. How should I get it formatted for Splunk to know what we're going for?
