What is the log format Web Intelligence app expects apache log files in? This is how I have setup the format but web intelligence does not show any data.
www.test.test.com 180.148.99.141 - - [13/Jan/2012:13:55:09 -0500] "GET /portlets/current_news.json?BLOCKSIZE=30 HTTP/1.1" 200 15588 "-" "Jakarta Commons-HttpClient/3.1"0/194888
Per Splunk's default field extractions:
[access-extractions]
# matches access-common or access-combined apache logging formats
# Extracts: clientip, clientport, ident, user, req_time, method, uri, root, file, uri_domain, uri_query, version, status, bytes, referer_url, referer_domain, referer_proto, useragent, cookie, other (remaining chars)
Your logs seem formatted correctly, but perhaps you have not assigned them the sourcetype of "access_combined". What sourcetype do your Apache logs currently show?
[folded comment in to question - araitz]