Can you provide a snippet of the data in text format, with both formats included? update: sorry scratch below, I didn't see the jpg Better yet you can use the IFX tool to extract on your own... http://docs.splunk.com/Documentation/Splunk/6.3.0/Knowledge/ExtractfieldsinteractivelywithIFX ... View more

I agree with @HiroshiSatoh, there is not enough information to provide you with good direction. Hot buckets automatically move to warm based on several factors, such as size of the buckets, quantity of buckets(limit reached), idle time etc. These values can be tweaked/adjusted in indexes.conf, but you should be careful you understand what/why you are changing. ... View more

Have you created a sourcetype for this data type? You would likely need to do this at the forwarder (props), break on time or use MAX_TIMESTAMP_LOOKAHEAD. ... View more