topic Re: Easy way to add access_combined to the Web Data Model in All Apps and Add-ons

Easy way to add access_combined to the Web Data Model

sloshburch — Thu, 25 Aug 2016 20:35:35 GMT

This question is not just asking about how to generally add data to a CIM (http://docs.splunk.com/Documentation/CIM/latest/User/UsetheCIMtonormalizedataatsearchtime)

Many apps come with sourcetypes predefined and ready to go with eventtypes and tags so they work with Common Information Model Data Models immediately (AWS TA for example). I'm not seeing anything like that for access_combined. Am I missing something obvious here? If there exists a definition of the eventtype, tags, field aliases, etc.. then I'd love to use that instead of building it on my own.

Re: Easy way to add access_combined to the Web Data Model

gfuente — Fri, 26 Aug 2016 12:36:36 GMT

Have you checked this addon?

https://splunkbase.splunk.com/app/3186/#/overview

You may just need to change the sourcetype to apache:access

Reagrds

Re: Easy way to add access_combined to the Web Data Model

sloshburch — Fri, 26 Aug 2016 14:56:23 GMT

Thanks. I'm also reaching out to the docs team to ask them to reference https://splunkbase.splunk.com/apps/#/page/1/search/CIM-compatible/order/relevance/supported/splunk if not done already. I think it's good to highlight those options.

Re: Easy way to add access_combined to the Web Data Model

sloshburch — Fri, 26 Aug 2016 19:11:45 GMT

Seems very restrictive according to http://docs.splunk.com/Documentation/AddOns/released/ApacheWebServer/Configure. Am I missing something? I also posted here: https://answers.splunk.com/answers/445097/splunk-add-on-for-apache-web-server-too-restrictiv.html

Re: Easy way to add access_combined to the Web Data Model

aivarson_splunk — Tue, 10 Jan 2017 16:15:39 GMT

Just created an add-on for this in case you don't want to change your sourcetype from the out of the box access_combined: https://splunkbase.splunk.com/app/3434/

Re: Easy way to add access_combined to the Web Data Model

sloshburch — Wed, 11 Jan 2017 13:18:45 GMT

I'll check it out. Assuming it works I'll probably switch the accepted answer to this one.