I don't have imap or the app installed, so you'll have to go down that road alone. Hopefully it'll be straightforward to change/set the indexHeaders and indexBody and see if they get your events coming in without the headers. I suspect if you look through inputs.conf in the app you'll figure it out - it'll be mostly configured, you'll just need to add a line or two.
Your event line breaking and timestamp recognition may actually "just work" once you get the above changes made. Splunk's pretty good about figuring out timestamps that are in a fairly normal format, and those look relatively non-weird. It should linebreak properly as well, I think, because your data looks line-oriented with carriage returns/line breaks as appropriate.
Can you give those a try then let us know how it went? If you have specific issues with any particular piece, please post back your problems with specifics (or create a new question, which will get new people looking at the problem).
... View more
this is probably because of the missing year in the airport syslog output.
Splunk uses the following precedence rules to assign timestamps to events:
Splunk looks for a time or date in the event itself using an explicit TIME_FORMAT , if provided. You configure the TIME_FORMAT attribute in props.conf.
If no TIME_FORMAT was configured for the data, Splunk Enterprise attempts to automatically identify a time or date in the event itself. It uses the source type of the event (which includes TIME_FORMAT information) to try to find the timestamp.
If an event doesn't have a time or date, Splunk Enterprise uses the timestamp from the most recent previous event of the same source.
If no events in a source have a date, Splunk Enterprise tries to find one in the source name or file name. (This requires that the events have a time, even though they don't have a date.)
For file sources, if no date can be identified in the file name, Splunk Enterprise uses the file's modification time.
As a last resort, Splunk Enterprise sets the timestamp to the current system time when indexing each event.
Now what you can do, read about How to Configure time stamp recognition and adapt props.conf to your needs.
hope this helps ...
... View more