topic Re: Apache logs relevant field name not showing in details log in Splunk Search

Why is apache logs relevant field name not showing in details log?

Jaycybersec — Fri, 11 Mar 2022 19:26:20 GMT

Hello ,

I have installed forwarder on Linux system and able to see logs in searches but the when i open a detailed log the field & value is missing for the relevant part of raw log.

All the useful details are missing in field.

Ip address, status code, bytes, user agent name, method used etc.. are missing.

can anyone guide here how to see those relevant things inside events.

Re: Apache logs relevant field name not showing in details log

richgalloway — Fri, 11 Mar 2022 19:23:03 GMT

Have you installed an app to process the events for you? Splunk Add-on for Apache Web Server (https://splunkbase.splunk.com/app/3186/) looks like a good candidate.

Re: Apache logs relevant field name not showing in details log

Jaycybersec — Fri, 11 Mar 2022 20:10:46 GMT

Hi,

Thanks for your response.

Have installed the app and restarted the service but still unable to see those relevant fields.

Re: Apache logs relevant field name not showing in details log

richgalloway — Fri, 11 Mar 2022 20:35:32 GMT

The issue seems to stem, at least in part, from the sourcetype "access-too_small". It's unlikely any add-on uses that sourcetype so none will extract any fields for it.

The "-too_small" issue usually arises when the input does not specify a sourcetype and there's not enough data for Splunk to analyze and make a guess about the sourcetype. Make sure the inputs.conf file with the [monitor:///var/log/apache2/access.log] stanza has a sourcetype setting,

Re: Apache logs relevant field name not showing in details log

Jaycybersec — Sat, 12 Mar 2022 06:21:28 GMT

Hi,

i have done the suggested steps and it's working fine and showing the relevant field.

Thanks .

Re: Apache logs relevant field name not showing in details log

richgalloway — Sat, 12 Mar 2022 13:23:05 GMT

Great! If your problem is resolved, then please click the "Accept as Solution" button to help future readers.