topic Re: Are there field extractions available for IPlanet web access logs? in Splunk Search

Are there field extractions available for IPlanet web access logs?

ndoshi — Mon, 11 Mar 2013 19:54:51 GMT

Here's the fields followed by a description:

Hostname or IP address of client

arrow.a.com. (In this case, the hostname is shown because the web server's setting for DNS lookups is enabled; if DNS lookups were disabled, the client's IP address would appear.

RFC 931 information

(RFC 931 identity not implemented)

Username

john (username entered by the client for authentication)

Date/time of request

29/Mar/1999:4:36:53 -0800

Request

GET /help

Protocol

HTTP/1.0

Status code

401

Bytes transferred

571

Re: Are there field extractions available for IPlanet web access logs?

ndoshi — Mon, 11 Mar 2013 19:55:38 GMT

Try these in props.conf

[iplanet]
EXTRACT-myfields=^(?.?[^\s])\s-\s(?.?[^\s])\s[(?.?)]\s\"(?\w+)\s(?.?[^\s])\s(?.*?)"\s(?\d+)\s(?\d+)\s(?\d+)

Re: Are there field extractions available for IPlanet web access logs?

ndoshi — Mon, 11 Mar 2013 20:18:26 GMT

BTW, the other field is probably not needed. It's there in case you have some integer at the end of the event that is unaccounted for.

Re: Are there field extractions available for IPlanet web access logs?

kvaga — Sun, 10 Jun 2018 16:53:44 GMT

Hello! I have more than five implementations of iplanet log files format string. Because a format of any web access log depends on the administrator who manages server.
Give me a few rows of your own log file and I'll give you exact string of field extraction

Re: Are there field extractions available for IPlanet web access logs?

scruse — Tue, 18 Dec 2018 15:32:26 GMT

@kvaga i have a similar issue, how can i provide you with a sanitized sample so i dont repeat work already completed on this tech