topic Re: splunk wont recognize apache access logs in Getting Data In

splunk wont recognize apache access logs

tven7 — Fri, 02 Sep 2011 01:52:01 GMT

I tried to force the sourcetype to access_combined. Even then i do not see the field extractions related to apache log fields. Is there any reason why this would be failing?

Re: splunk wont recognize apache access logs

tven7 — Fri, 02 Sep 2011 02:13:53 GMT

I set the access_combined in inputs.conf under deployment-apps and restarted the deployment server to propogate to the forwarders.

path is
/data/splunkdeployment/splunk/etc/deployment-apps/liferayProdApp/local

Re: splunk wont recognize apache access logs

lguinn2 — Sat, 03 Sep 2011 16:47:45 GMT

Can you post the actual stanza that you are using? Can you verify that the inputs.conf was actually propogated to the forwarders?

Re: splunk wont recognize apache access logs

advaitk — Fri, 12 Jul 2013 18:41:40 GMT

responding late since i ran into this and was left scratching my help.
so hopefully this helps someone else.
you have to very careful with the source data format (what is being logged in the log files by the web server).
in my case, i was using a CustomLog configuration in Apache, and using an unused field (%l - Remote logname), with some request header value but was double quoting the value.
splunk wasn't quite liking that, once i removed the double quotes, splunk loved it.