I'd be more than happy to help set up what you need. We're relatively familiar with the PI system and certainly very familiar with Splunk.
If you send a short sample of the log and some details about what you're looking to do with it, I'd be happy to set up the field extractions and walk you through the searches and reports to get the job done.
I'd also love to know more about exactly which message log you're interested in. In my understanding there's one message log at the server and another at the interface? Or we could also write a scripted input in Splunk to just get the messages from PI directly. In any event more details are crucial.
nick@sideviewapps.com.
