https://community.splunk.com/t5/Getting-Data-In/splunk-syslog-configuration/m-p/49499#M96757 <P>Do following on the UI: Manager » Data inputs » Files &amp; Directories » Add New</P> <UL> <LI>Monitor a file or directory : &lt; your_path_to_the_file &gt; (eg. /var/logs/apache/apache_access.log)</LI> <LI>Host field value : &lt; your_servername &gt;</LI> <LI>Set sourcetype : Manual</LI> <LI>Source type : &lt; apache_access &gt;</LI> <LI>Index : default</LI> </UL> <P>Save the whole thing, go back to the search app and type: sourcetype=apache_access</P> <UL> <LI><A href="http://www.splunk.com/base/Documentation/latest/Admin/WhatSplunkcanmonitor" rel="nofollow">http://www.splunk.com/base/Documentation/latest/Admin/WhatSplunkcanmonitor</A></LI> <LI><A href="http://www.splunk.com/base/Documentation/latest/Admin/Monitorfilesanddirectories" rel="nofollow">http://www.splunk.com/base/Documentation/latest/Admin/Monitorfilesanddirectories</A></LI> </UL> Thu, 24 Feb 2011 17:01:30 GMT LCM 2011-02-24T17:01:30Z https://community.splunk.com/t5/Getting-Data-In/splunk-syslog-configuration/m-p/49498#M96756 <P>How to monitor apache access log with splunk</P> Thu, 24 Feb 2011 16:14:37 GMT https://community.splunk.com/t5/Getting-Data-In/splunk-syslog-configuration/m-p/49498#M96756 bwenge 2011-02-24T16:14:37Z https://community.splunk.com/t5/Getting-Data-In/splunk-syslog-configuration/m-p/49499#M96757 <P>Do following on the UI: Manager » Data inputs » Files &amp; Directories » Add New</P> <UL> <LI>Monitor a file or directory : &lt; your_path_to_the_file &gt; (eg. /var/logs/apache/apache_access.log)</LI> <LI>Host field value : &lt; your_servername &gt;</LI> <LI>Set sourcetype : Manual</LI> <LI>Source type : &lt; apache_access &gt;</LI> <LI>Index : default</LI> </UL> <P>Save the whole thing, go back to the search app and type: sourcetype=apache_access</P> <UL> <LI><A href="http://www.splunk.com/base/Documentation/latest/Admin/WhatSplunkcanmonitor" rel="nofollow">http://www.splunk.com/base/Documentation/latest/Admin/WhatSplunkcanmonitor</A></LI> <LI><A href="http://www.splunk.com/base/Documentation/latest/Admin/Monitorfilesanddirectories" rel="nofollow">http://www.splunk.com/base/Documentation/latest/Admin/Monitorfilesanddirectories</A></LI> </UL> Thu, 24 Feb 2011 17:01:30 GMT https://community.splunk.com/t5/Getting-Data-In/splunk-syslog-configuration/m-p/49499#M96757 LCM 2011-02-24T17:01:30Z