Web Intelligence - No Results found with customized sourcetype

[starndawn]

The sourcetype is customized, not default access_combined/access_custom format. I can preview the data after setting the sourcetype in setup page. But the dashboard returns "No Results found". Can web intelligence only work in default sourcetype access_combined? The "data exploration -> search " can return result even I don't point out the sourcetype in the query. Thanks.

[MartinHarper]

If you have a customized web log format, you may need to use Field Extraction to get the fields out of the log, depending on what your log looks like (can you tell us?).

Once you have extracted the fields, depending on how they are extracted, you may need to use Field Alias to make sure the fields are named correctly. Here is a list of field aliases that may be needed, taken from [access-extractions] in default/transforms.conf

[access-extractions]
# matches access-common or access-combined apache logging formats
# Extracts: clientip, clientport, ident, user, req_time, method, uri, root, file, uri_domain, uri_query, version, status, bytes, referer_url, referer_domain, referer_proto, useragent, cookie, other (remaining chars)  
# Note: referer is misspelled in purpose because that is the "official" spelling for "HTTP referer" 

[starndawn]

so it looks like the web intelligence doesn't work with customized web log format, doesn't it?

[sdaniels]

Please take a look at the following:

http://splunk-base.splunk.com/answers/34974/no-results-found-using-web-intelligence-app

http://splunk-base.splunk.com/answers/48239/web-intelligence-app-empty

The one thing I can think is the format of your sourcetype needs to match the expected access logs.

http://httpd.apache.org/docs/2.2/logs.html