https://community.splunk.com/t5/Splunk-Search/Fields-extraction-from-access-log/m-p/168260#M47975 <P>I would like to list below log in 8 parts and I'm not sure how to do it in with Regex. Please help me</P> <PRE><CODE>{Field 1] {Field 2 } {Field 3] [field 4] [field5] [field6] [field 7][field 8} 10.16.124.34 - pavan kumar [09/Aug/2011:11:15:11 -0500] "GET /sbconsole/ HTTP/1.1" 302 355 </CODE></PRE> Sat, 02 Aug 2014 04:08:15 GMT pavan_bhumanapa 2014-08-02T04:08:15Z https://community.splunk.com/t5/Splunk-Search/Fields-extraction-from-access-log/m-p/168260#M47975 <P>I would like to list below log in 8 parts and I'm not sure how to do it in with Regex. Please help me</P> <PRE><CODE>{Field 1] {Field 2 } {Field 3] [field 4] [field5] [field6] [field 7][field 8} 10.16.124.34 - pavan kumar [09/Aug/2011:11:15:11 -0500] "GET /sbconsole/ HTTP/1.1" 302 355 </CODE></PRE> Sat, 02 Aug 2014 04:08:15 GMT https://community.splunk.com/t5/Splunk-Search/Fields-extraction-from-access-log/m-p/168260#M47975 pavan_bhumanapa 2014-08-02T04:08:15Z https://community.splunk.com/t5/Splunk-Search/Fields-extraction-from-access-log/m-p/168261#M47976 <P>If this is an Apache access log, you could simply assign it one of the Apache sourcetypes when you index it:</P> <P><CODE>access_combined</CODE> would probably work, but <CODE>access_combined_wcookie</CODE> might also be an option.</P> Sat, 02 Aug 2014 06:16:37 GMT https://community.splunk.com/t5/Splunk-Search/Fields-extraction-from-access-log/m-p/168261#M47976 lguinn2 2014-08-02T06:16:37Z