Archive
Highlighted

splunk wont recognize apache access logs

Path Finder

I tried to force the sourcetype to access_combined. Even then i do not see the field extractions related to apache log fields. Is there any reason why this would be failing?

Tags (1)
0 Karma
Highlighted

Re: splunk wont recognize apache access logs

Path Finder

I set the access_combined in inputs.conf under deployment-apps and restarted the deployment server to propogate to the forwarders.

path is
/data/splunkdeployment/splunk/etc/deployment-apps/liferayProdApp/local

0 Karma
Highlighted

Re: splunk wont recognize apache access logs

Legend

Can you post the actual stanza that you are using? Can you verify that the inputs.conf was actually propogated to the forwarders?

0 Karma
Highlighted

Re: splunk wont recognize apache access logs

New Member

responding late since i ran into this and was left scratching my help.
so hopefully this helps someone else.
you have to very careful with the source data format (what is being logged in the log files by the web server).
in my case, i was using a CustomLog configuration in Apache, and using an unused field (%l - Remote logname), with some request header value but was double quoting the value.
splunk wasn't quite liking that, once i removed the double quotes, splunk loved it.

0 Karma