Post a full event. Mask any sensitive data as needed - but please post a full event. Highlight the timestamp you want/need splunk to understand. Obviously it does not parse the time properly. There will most likely be DateParserVerbose error messages in the splunkd.log file. Don't know if they will tell you why it didn't work to parse your timestamp, though. ... View more

If you could include some metrics you would like, it might be easier to show you specifics. But the general format is: sourcetype="Traffic" | timechart count by Message span=5m This will show the count by Message over time. http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Timechart ... View more

1.4004771683629058/d:latitude 103.8579338813216/d:longitude Given the data format above, I would choose to do like so; props.conf [your_sourcetype] EXTRACT-lat = >(?<latitude>[^<]+)</d:latitude EXTRACT-long = >(?<longitude>[^<]+)</d:longitude /K ... View more

I am facing the same issue " Unable to initialize modular input "testfile" defined inside the app "test1": Introspecting scheme=testfile: script running failed (exited with code 1)." The modular input is developed using java . any hints on coming out of this problem is greatly appreciated . ... View more