Doubt in framing search

[Jananee_iNautix]

There are different log files in different format. A log file is generated from the different log files and fed into Splunk.

For instance,
1.Success:Filename was [d8.csv]. File length was [1403]. Connected to host [feruifg.com].
2.Success:The FTP Server [rferergerg] uploaded file [113237579.csv] of length 1989 bytes from userid [NID].
3.Failure:Could not download file 201207 from [ftfew]. Reason: 550 I can only retrieve regular files.

The above information (#1 and #2) contains filename, Servername / hostname, file length but they are available in different formats as they are from different logs but combined into one log file before feeding it into Splunk.

Which would be an efficient way to extract the information from the log statements?
1. Apply different searches for different formats and combine them using append to display it in a single table?
2. Apply a common search for different formats?

[richgalloway]

I vote for option #1. It's simpler than trying to come up with a grand unified search for all of the different formats. Remember, someone is going to have to maintain this search so keep it simple.

[ankireddy007]

It depends on the use case which you want to find from the log.

I suggest, assign different "source types" for the different formats of data at the time of indexing itself. So that field extraction will be easier, by restricting field property to the level of "Source Type".