topic Re: Extract Fields Apache Logs in Splunk Search

Extract Fields Apache Logs

miguelebf — Tue, 30 Jul 2019 05:46:38 GMT

Hi i have raw data like this:
192.0.100.3 - - [30/Jul/2019:00:06:05 -0500] "GET /test/ HTTP/1.1" 403 207 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36"
clientip = 192.0.200.2 host = cliente uri = /test/ useragent = Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

and i need ectract IP , Time ,User Agent , and URL help please, its a logs from apache

Re: Extract Fields Apache Logs

jawaharas — Tue, 30 Jul 2019 10:19:17 GMT

Have you tried using default 'access_combined' sourcetype ?
https://docs.splunk.com/Documentation/Splunk/7.3.0/Data/Listofpretrainedsourcetypes

if the sourcetype not available, try below add-on(Add-on for Access Combined) -
https://splunkbase.splunk.com/app/3434/

Re: Extract Fields Apache Logs

jawaharas — Mon, 05 Aug 2019 06:33:52 GMT

@miguelebf
Can you accept the answer if it's helped you? Thanks.