Hello Splunk experts, my log files are structured in the following way:
09032011 12:23:34.567 App name: TestApp01, App version: 2.34, Server time zone: -0700
09042011 01:12:32.800 event 01
09052011 04:11:31.123 event 02
09052011 05:54:20.482 event 03
The first line contains information pertaining to all events that are recorded in the same log file, and the logs can grow to thousands of lines.
I am having two issues:
1. Can I extract the -0700 time zone info from the first line of the log, then have Splunk index all events within this log with this time zone? Right now these events are assigned with the Splunk server time zone which gets messy as I have logs coming from various time zones.
2. Can I extract the App name and App version fields, then add these fields to the subsequent events within the same log, so that a query like [search AppName="TestApp01" AND AppVersion="2.34"] would return all events from the same log file? (multi-line event or | transaction can do the trick but only for smaller log files. Unfortunately most are large files, making these methods unrealistic)
Thanks in advance!
... View more