Cognos has some very precarious logs that we have to search through from time to time, and during these times I want to poke my eyes out with a rusty nail. However, Splunk has made this entire process much easier through their search capabilities – especially the IFX interface.
We were able to find a pattern for the PID, SessionID, and RequestID in the logs, but they do not fall into a key-value pair pattern. They are separated by what appear to be spaces in the logs. Splunk’s IFX allowed us to easily go through the data and select which "columns" were for the PID, SessionID, and RequestID. So now when we search through the data, we are automatically given data counts for all of the aforementioned fields.
Their tutorial was extremely easy to follow as well:
http://www.splunk.com/base/Documentation/latest/User/Fieldsextractiontutorial
