topic Re: splunkd_ui_access logs in Splunk Search

splunkd_ui_access logs

Abass42 — Fri, 02 Aug 2024 21:56:26 GMT

Im trying to create some dashboards to make reading _internal logs easier. I'm trying to figure out what all for the fields we are getting in are. This Splunk Doc has the gist of what I am looking at, but we have more fields than that.

In the doc it mentions something about apache and its logs, and whereas we do use apache, im not well versed in it enough to understand what i was looking at fully. I think we are adding in extracted fields, or adding in values in the processing that Splunk does. How can i track down what .conf file is adding the fields. Id like to have a better understanding of where these values come from. There are a lot more fields than the _raw logs seem to have. Like metadata.

Re: splunkd_ui_access logs

yuanliu — Sat, 03 Aug 2024 03:38:07 GMT

The document is saying that the splunkd_ui_access.log uses the Apache access.log common format. So, the same extraction is applied. It is unrelated to your use of Apache httpd.

If you have more fields, you need to illustrate your data and point out where additional information can be extracted.

Re: splunkd_ui_access logs

ITWhisperer — Sat, 03 Aug 2024 07:10:48 GMT

Which exact fields are you interested in?