https://community.splunk.com/t5/Splunk-Dev/Web-Intelligence-for-apache-logs/m-p/51228#M670 <P>Per Splunk's default field extractions:</P> <PRE><CODE>[access-extractions] # matches access-common or access-combined apache logging formats # Extracts: clientip, clientport, ident, user, req_time, method, uri, root, file, uri_domain, uri_query, version, status, bytes, referer_url, referer_domain, referer_proto, useragent, cookie, other (remaining chars) </CODE></PRE> <P>Your logs seem formatted correctly, but perhaps you have not assigned them the sourcetype of "access_combined". What sourcetype do your Apache logs currently show?</P> Mon, 16 Jan 2012 16:02:17 GMT araitz 2012-01-16T16:02:17Z https://community.splunk.com/t5/Splunk-Dev/Web-Intelligence-for-apache-logs/m-p/51226#M668 <P>What is the log format Web Intelligence app expects apache log files in? This is how I have setup the format but web intelligence does not show any data.</P> <PRE><CODE><A href="https://community.splunk.com/www.test.test.com" target="test_blank">www.test.test.com</A> 180.148.99.141 - - [13/Jan/2012:13:55:09 -0500] "GET /portlets/current_news.json?BLOCKSIZE=30 HTTP/1.1" 200 15588 "-" "Jakarta Commons-HttpClient/3.1"0/194888 </CODE></PRE> Fri, 13 Jan 2012 19:42:31 GMT https://community.splunk.com/t5/Splunk-Dev/Web-Intelligence-for-apache-logs/m-p/51226#M668 heinrich_piard 2012-01-13T19:42:31Z https://community.splunk.com/t5/Splunk-Dev/Web-Intelligence-for-apache-logs/m-p/51227#M669 <P>[folded comment in to question - araitz]</P> Fri, 13 Jan 2012 19:43:31 GMT https://community.splunk.com/t5/Splunk-Dev/Web-Intelligence-for-apache-logs/m-p/51227#M669 heinrich_piard 2012-01-13T19:43:31Z https://community.splunk.com/t5/Splunk-Dev/Web-Intelligence-for-apache-logs/m-p/51228#M670 <P>Per Splunk's default field extractions:</P> <PRE><CODE>[access-extractions] # matches access-common or access-combined apache logging formats # Extracts: clientip, clientport, ident, user, req_time, method, uri, root, file, uri_domain, uri_query, version, status, bytes, referer_url, referer_domain, referer_proto, useragent, cookie, other (remaining chars) </CODE></PRE> <P>Your logs seem formatted correctly, but perhaps you have not assigned them the sourcetype of "access_combined". What sourcetype do your Apache logs currently show?</P> Mon, 16 Jan 2012 16:02:17 GMT https://community.splunk.com/t5/Splunk-Dev/Web-Intelligence-for-apache-logs/m-p/51228#M670 araitz 2012-01-16T16:02:17Z