https://community.splunk.com/t5/Getting-Data-In/access-combined-Field-Definitions/m-p/106671#M97587 <P>I haven't been able to find definitions of the access_combined source type fields. Does anyone know where they might exist? Thanks!</P> Fri, 18 Oct 2013 20:08:11 GMT sjwone 2013-10-18T20:08:11Z https://community.splunk.com/t5/Getting-Data-In/access-combined-Field-Definitions/m-p/106671#M97587 <P>I haven't been able to find definitions of the access_combined source type fields. Does anyone know where they might exist? Thanks!</P> Fri, 18 Oct 2013 20:08:11 GMT https://community.splunk.com/t5/Getting-Data-In/access-combined-Field-Definitions/m-p/106671#M97587 sjwone 2013-10-18T20:08:11Z https://community.splunk.com/t5/Getting-Data-In/access-combined-Field-Definitions/m-p/106672#M97588 <P>The extractions are found in configuration files in $SPLUNK_HOME/etc/system/default/</P> <P>props.conf (from where the extraction is called)</P> <PRE><CODE>[access_combined] REPORT-access = access-extractions </CODE></PRE> <P>transforms.conf (where it actually happens)</P> <PRE><CODE>[access-extractions] # matches access-common or access-combined apache logging formats # Extracts: clientip, clientport, ident, user, req_time, method, uri, root, file, uri_domain, uri_query, version, status, bytes, referer_url, referer_domain, referer_proto, useragent, cookie, other (remaining c hars) # Note: referer is misspelled in purpose because that is the "official" spelling for "HTTP referer" REGEX = ^[[nspaces:clientip]]\s++[[nspaces:ident]]\s++[[nspaces:user]]\s++[[sbstring:req_time]]\s++[[acce ss-request]]\s++[[nspaces:status]]\s++[[nspaces:bytes]](?:\s++"(?&lt;referer&gt;[[bc_domain:referer_]]?+[^"]*+) "(?:\s++[[qstring:useragent]](?:\s++[[qstring:cookie]])?+)?+)?[[all:other]] </CODE></PRE> <P>Whatever you do, don't modify any file in a 'default' directory.</P> <P>/K</P> Fri, 18 Oct 2013 20:25:01 GMT https://community.splunk.com/t5/Getting-Data-In/access-combined-Field-Definitions/m-p/106672#M97588 kristian_kolb 2013-10-18T20:25:01Z