I agree with @richgalloway. IMHO, nobody should do this BUT if you do, be aware that you will get a tone of warnings in your logs which say something like "WARN: could not find timestamp; timestamp defaulted to that of the previous event" which is exactly the correct thing to do (but you will not be able to stop the warnings). ... View more

Check out these apps: https://splunkbase.splunk.com/app/2632/ https://splunkbase.splunk.com/app/493/ https://splunkbase.splunk.com/app/3241/ https://splunkbase.splunk.com/app/493/ ... View more