topic Re: SplunkforSquid Logformat in Splunk Search

SplunkforSquid Logformat

imarks004 — Wed, 29 Dec 2010 11:14:21 GMT

Is there a specific logging format that I should set in the SplunkforSquid app to get the proper field extraction? I am running Squid 2.6 with the following logformat which does not seem to match up with the extractions in this app:

logformat squid  %ts.%03tu %6tr %>a %Ss/%03Hs %<st %rm %ru %un %Sh/%<A %mt

Re: SplunkforSquid Logformat

Ayn — Wed, 29 Dec 2010 17:32:31 GMT

Splunk for Squid assumes that the Squid access logs are in default format, which is what you seem to be using. Are you using sourcetype "squid"? Could you post a sample log event for troubleshooting?

Regards, Patrik

Re: SplunkforSquid Logformat

imarks004 — Mon, 28 Sep 2020 09:22:35 GMT

Hi Patrik, Here is an example of a sourcetype=squid search.
1293720507.168 322 10.163.4.75 TCP_MISS/200 6631 CONNECT xmlrpc.rhn.redhat.com:443 - DIRECT/209.132.183.44 -
1293720553.568 488 10.7.0.13 TCP_MISS/200 4594 CONNECT update-manifests.ironport.com:443 - DIRECT/204.15.82.17 -
1293720553.589 17 10.7.0.13 TCP_MISS/200 9609 GET http://updates.ironport.com/ibrs/1.1/ip/ips1g/1293720247.inc - DIRECT/184.84.247.25 text/plain

Re: SplunkforSquid Logformat

Ayn — Mon, 10 Jan 2011 16:24:58 GMT

Thank you. These events are formatted in a way that the field extractions handle, so my best guess would be that the sourcetype is something other than "squid" (as the field extractions only apply to this sourcetype). Could you please verify the sourcetype you're using?