https://community.splunk.com/t5/Getting-Data-In/httpd-conf-configuration-for-logging-recommendation/m-p/232079#M45232 <P>If you have this "luxury" you can try to conform your data to the Splunk industry standard one from - <A href="http://docs.splunk.com/Documentation/Splunk/6.4.2/Data/Listofpretrainedsourcetypes">List of pretrained source types</A></P> <P>This can be pretty cheerful if you manage to do it - one of my dreams in my current place ; - )</P> Thu, 18 Aug 2016 00:59:10 GMT ddrillic 2016-08-18T00:59:10Z https://community.splunk.com/t5/Getting-Data-In/httpd-conf-configuration-for-logging-recommendation/m-p/232078#M45231 <P>All, </P> <P>We have legacy servers going years back and newer ones etc. Basically, we have ended up with about 30 different settings in httpd.conf for logging. They asked me what I want the standard to be for Splunk reasons. Started to think about that, and is there any reason why I shouldn't directly ask for CIM friendly key value pairs rights now in the source? </P> <P>LogFormat </P> <PRE><CODE>%t src_ip=%h RemoteLogName=%l RemoteUser=%u request=\"%r\" %&gt;s %b \"%{Referer}i\" http_user_agent=\"%{User-Agent}i\" </CODE></PRE> <P>Example:</P> <PRE><CODE>[17/Aug/2016:20:20:27 -0400] src_ip=192.168.1.47 RemoteLogName=- RemoteUser=- request="GET /default.html HTTP/1.1" 304 - "-" http_user_agent="Mozilla/5.0 (Macintosh; Inte.... </CODE></PRE> Thu, 18 Aug 2016 00:28:17 GMT https://community.splunk.com/t5/Getting-Data-In/httpd-conf-configuration-for-logging-recommendation/m-p/232078#M45231 daniel333 2016-08-18T00:28:17Z https://community.splunk.com/t5/Getting-Data-In/httpd-conf-configuration-for-logging-recommendation/m-p/232079#M45232 <P>If you have this "luxury" you can try to conform your data to the Splunk industry standard one from - <A href="http://docs.splunk.com/Documentation/Splunk/6.4.2/Data/Listofpretrainedsourcetypes">List of pretrained source types</A></P> <P>This can be pretty cheerful if you manage to do it - one of my dreams in my current place ; - )</P> Thu, 18 Aug 2016 00:59:10 GMT https://community.splunk.com/t5/Getting-Data-In/httpd-conf-configuration-for-logging-recommendation/m-p/232079#M45232 ddrillic 2016-08-18T00:59:10Z