Thank you very much. That explains it better. 🙂 ... View more

transtrophe - I'm late to this party, but did you ever file this as an enhancement request? I'll happily pile on if you did. ... View more

This is an old question, but the HTTP event collector is a good answer (and didn't exist at the time the last answers were added.) Rather than parsing a log, it's a HTTP POST to an endpoint. Docs are here: http://docs.splunk.com/Documentation/Splunk/6.4.3/Data/UsetheHTTPEventCollector . ... View more