topic Re: Has anyone experienced this squid error with splunk_recommended_squid log format? in Getting Data In

Has anyone experienced this squid error with splunk_recommended_squid log format?

rsd0991 — Wed, 14 Dec 2022 17:12:30 GMT

i am running Squid 5.2 and having an issue adding the splunk_recommended_squid log format to my squid configuration. Pulled the log format right out of the splunk documentation. i'll paste it at the end of this message. When i try and start squid with that log format, i get an error:

" FATAL: Bungled /etc/squid/squid.conf line 11: logformat splunk_squid %ts.%03tu logformat=splunk_recommended_squid duration=%tr src_ip=%>a src_port=%>p dest_ip=%<a dest_port=%<p user_ident="%[ui" user="%[un" local_time=[%tl] http_method=%rm request_method_from_client=%<rm request_method_to_server=%>rm url="%ru" http_referrer="%{Referer}>h" http_user_agent="%{User-Agent}>h" status=%>Hs vendor_action=%Ss dest_status=%Sh total_time_milliseconds=%<tt http_content_type="%mt" bytes=%st bytes_in=%>st bytes_out=%<st sni="%ssl::>sni"

I haven't been able to find anything solid to help out with this. has anyone else experienced this?

Thanks

-Rob

Re: Has anyone experienced this squid error with splunk_recommended_squid log format?

Ludvik — Tue, 26 Sep 2023 17:52:26 GMT

Yes, it has to do with a bad log format in Squid 😠 and no one updated the docs. I solved via Squid docs and process of elimination. I can't seem to get the ssl::sni to work at all but this is all of the options without ssl::sni.

logformat splunk_recommended_squid %ts.%03tu logformat=splunk_recommended_squid duration=%tr src_ip=%>a src_port=%>p dest_ip=%<a dest_port=%<p user_ident="%ui" user="%un" local_time=[%tl] http_method=%rm request_method_from_client=%<rm request_method_to_server=%>rm url="%ru" http_referrer="%{Referer}>h" http_user_agent="%{User-Agent}>h" status=%>Hs vendor_action=%Ss dest_status=%Sh total_time_milliseconds=%<tt http_content_type="%mt" bytes=%st bytes_in=%>st bytes_out=%<st

Re: Has anyone experienced this squid error with splunk_recommended_squid log format?

user4567654 — Fri, 06 Oct 2023 02:40:23 GMT

Thank you!

Re: Has anyone experienced this squid error with splunk_recommended_squid log format?

josevg1981 — Tue, 05 Aug 2025 12:17:05 GMT

Ty men , sooo helpful .