https://community.splunk.com/t5/Splunk-Search/Splunk-for-squid-document-not-enough-can-any-one-plz-give/m-p/146824#M185258 <P>To monitor a squid access log, you should only need to set up an input, either via the GUI if the file is located on an indexer, or via <CODE>inputs.conf</CODE> if the file is located on a forwarder.</P> <P>As part of setting up the input, you should assign a sourcetype. Hopefully, you can use an existing sourcetype. If not, you can define your own. Here is some information about sourcetypes (within the page you will also find a link to the "pretrained sourcetypes").<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/Whysourcetypesmatter">Why sourcetypes matter</A></P> <P>Finally, once you have the data in Splunk, you can create a search and a graph.</P> <P>If you are confused by all of this, you might want to walk through the Splunk Tutorial or one of the free video tutorials <A href="http://www.splunk.com/view/SP-CAAAG2R">here</A>.</P> Thu, 02 Oct 2014 05:03:08 GMT lguinn2 2014-10-02T05:03:08Z https://community.splunk.com/t5/Splunk-Search/Splunk-for-squid-document-not-enough-can-any-one-plz-give/m-p/146823#M185257 <P>Splunk for squid document not enough..can any one plz give configuration of splunk to monitor squid access log with graph...</P> Wed, 01 Oct 2014 07:01:06 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-for-squid-document-not-enough-can-any-one-plz-give/m-p/146823#M185257 san89 2014-10-01T07:01:06Z https://community.splunk.com/t5/Splunk-Search/Splunk-for-squid-document-not-enough-can-any-one-plz-give/m-p/146824#M185258 <P>To monitor a squid access log, you should only need to set up an input, either via the GUI if the file is located on an indexer, or via <CODE>inputs.conf</CODE> if the file is located on a forwarder.</P> <P>As part of setting up the input, you should assign a sourcetype. Hopefully, you can use an existing sourcetype. If not, you can define your own. Here is some information about sourcetypes (within the page you will also find a link to the "pretrained sourcetypes").<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/Whysourcetypesmatter">Why sourcetypes matter</A></P> <P>Finally, once you have the data in Splunk, you can create a search and a graph.</P> <P>If you are confused by all of this, you might want to walk through the Splunk Tutorial or one of the free video tutorials <A href="http://www.splunk.com/view/SP-CAAAG2R">here</A>.</P> Thu, 02 Oct 2014 05:03:08 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-for-squid-document-not-enough-can-any-one-plz-give/m-p/146824#M185258 lguinn2 2014-10-02T05:03:08Z