Getting Data In

Apache Logs Data Parsing

anandhalagaras1
Contributor

Hi Team,

We have recently started ingesting Apache access and request logs from an application, but the data parsing isn't working as expected.

Could you please let me know the field names for these events so I can try to extract them manually? Alternatively, do we have any format or add-on available that would enable automatic field extraction? If so, that would also be fine with me.

For your information, our Splunk Search Head is hosted in the cloud and managed by Splunk Support.

I have provided the log structure for both log sources for reference. Please help to check and update.

 

Request Logs:
[09/Aug/2024:07:50:37 +0000] xx.yyy.zzz.aa TLSv1.2 ABCDE-FGH-IJK256-LMN-SHA123 "GET /share/page/ HTTP/1.1" xxxxx
[09/Aug/2024:07:50:37 +0000] xx.yyy.zzz.aa TLSv1.2 xxxxx-xxx-xxx256-xxx-xxx123 "GET /share/page/ HTTP/1.1" -


Access Logs:
xx.yyy.zzz.aa - - [09/Aug/2024:07:57:00 +0000] "GET /share/page/ HTTP/1.1" 200 xxxxx
aaa.bbb.ccc.dd - - [09/Aug/2024:07:56:53 +0000] "GET /share/page/ HTTP/1.1" 200 -

Thank you.

Labels (2)
0 Karma

anandhalagaras1
Contributor

Can Anyone help on my request please.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

1. This is not a Professional Support service. People do have their lives and respond when they have some spare time.

2. For typical apache httpd logs there are two built-in sourcetypes - access_combined and apache_error.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Splunk have default definitions for access_combined, access_combined_wcookie, access_common and apache_error. You can look those (.../system/default/props.conf and transforms.conf). You could use this as base for your own sourcetype definitions. 

0 Karma

anandhalagaras1
Contributor

I cloned the "access_combined" sourcetype for the access logs, and now the fields are being extracted as desired.

However, I'm unable to parse the request logs as expected. If anyone has some time, I would appreciate assistance with parsing the request logs. It would be really helpful.

 

Request Logs Format:
[09/Aug/2024:07:50:37 +0000] xx.yyy.zzz.aa TLSv1.2 ABCDE-FGH-IJK256-LMN-SHA123 "GET /share/page/ HTTP/1.1" xxxxx
[09/Aug/2024:07:50:37 +0000] xx.yyy.zzz.aa TLSv1.2 xxxxx-xxx-xxx256-xxx-xxx123 "GET /share/page/ HTTP/1.1" -

0 Karma
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...