Archive

access_combined Field Definitions

Explorer

I haven't been able to find definitions of the access_combined source type fields. Does anyone know where they might exist? Thanks!

Tags (1)
1 Solution

Ultra Champion

The extractions are found in configuration files in $SPLUNK_HOME/etc/system/default/

props.conf (from where the extraction is called)

[access_combined]
REPORT-access = access-extractions

transforms.conf (where it actually happens)

[access-extractions]
# matches access-common or access-combined apache logging formats
# Extracts: clientip, clientport, ident, user, req_time, method, uri, root, file, uri_domain, uri_query,
version, status, bytes, referer_url, referer_domain, referer_proto, useragent, cookie, other (remaining c
hars)
# Note: referer is misspelled in purpose because that is the "official" spelling for "HTTP referer"
REGEX = ^[[nspaces:clientip]]\s++[[nspaces:ident]]\s++[[nspaces:user]]\s++[[sbstring:req_time]]\s++[[acce
ss-request]]\s++[[nspaces:status]]\s++[[nspaces:bytes]](?:\s++"(?<referer>[[bc_domain:referer_]]?+[^"]*+)
"(?:\s++[[qstring:useragent]](?:\s++[[qstring:cookie]])?+)?+)?[[all:other]]

Whatever you do, don't modify any file in a 'default' directory.

/K

View solution in original post

Ultra Champion

The extractions are found in configuration files in $SPLUNK_HOME/etc/system/default/

props.conf (from where the extraction is called)

[access_combined]
REPORT-access = access-extractions

transforms.conf (where it actually happens)

[access-extractions]
# matches access-common or access-combined apache logging formats
# Extracts: clientip, clientport, ident, user, req_time, method, uri, root, file, uri_domain, uri_query,
version, status, bytes, referer_url, referer_domain, referer_proto, useragent, cookie, other (remaining c
hars)
# Note: referer is misspelled in purpose because that is the "official" spelling for "HTTP referer"
REGEX = ^[[nspaces:clientip]]\s++[[nspaces:ident]]\s++[[nspaces:user]]\s++[[sbstring:req_time]]\s++[[acce
ss-request]]\s++[[nspaces:status]]\s++[[nspaces:bytes]](?:\s++"(?<referer>[[bc_domain:referer_]]?+[^"]*+)
"(?:\s++[[qstring:useragent]](?:\s++[[qstring:cookie]])?+)?+)?[[all:other]]

Whatever you do, don't modify any file in a 'default' directory.

/K

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!