Getting Data In

How to parse Apache access logs in Splunk

snehalk
Communicator

Hello All,

We have the Apache access.log and am not able to parse it, first i used the "access_combined_wcookie" standard sourcetype but it wont work and am tried the tranforms.conf and props.conf file its parsing all filed except Cookies because it has the multiple value and my delimiter is Space( ).

%t %T %O %I %{X-Forwarded-For} %a %A %u %m %s \"%r\" %U %q \"%{User-Agent}i\" Cookies cs_referer 

Could you please help me on this?

Thanks in advance

jmallorquin
Builder

Hi,

Have you try use this?

https://splunkbase.splunk.com/app/3186/#/overview

Hope i help you

0 Karma

snehalk
Communicator

Hello Team,

Could you please any one help me on this?

0 Karma

jmallorquin
Builder

Hi,

Have you try use this?

https://splunkbase.splunk.com/app/3186/#/overview

Hope i help you

0 Karma

rafamss
Contributor

Hi snehalk,

Your file have a delimeter for this fields or your files always is delimeted by default ?

0 Karma

snehalk
Communicator

Hello Rafamss,

Here is transforms.conf file

[my_extract]
DELIMS = " "
FIELDS =%t %T %O %I %{X-Forwarded-For} %a %A %u %m %s \"%r\" %U %q \"%{User-Agent}i\" Cookies cs_referer 
0 Karma

jkat54
SplunkTrust
SplunkTrust

It appears you have "custom" apache logs. Please post an example of your apache access logs so we can help you.

0 Karma

snehalk
Communicator

Hello Jkat54,

Thanks for response, below is my log sample

[24/May/2016:02:33:20 -0400] 0 29045 1653 10.46.33.75 10.2.167.212 10.3.66.215 - GET 200 "GET /xyz/xyz/……../Home.jspx?_adddsdf.ctrl-state=14tsxsdsdseozt9_4&Adf-Rich-Message=true&unique=15353471600889&oracle.adf.view.rich.STREAM=temp:r1:0:t1&javax.faces.ViewState=!61ilzjmjl HTTP/1.1" /xyz/xyz/……../Home.jspx ?_adf.ctrl-state=14tsxeozt9_4&Adf-Rich-Message=true&unique=1464071600889&oracle.adf.view.rich.STREAM=temp:r1:0:t1&javax.faces.ViewState=!61ilzjmjl "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36" BlueStripe.PVN=e5667777; fkdfdkfd_dfd_dfd_df.app~dfff_fsd_sfsf_sfffs_pool=3611427594.24862.0000; qPRDSPOpenToken=T1RLAQKDuOytNwUp2Lua3o7WO_zuZRQjlBAsPUuHuSN-3x-Xcnj8g3EQAADwDV4Is9BgXuQT9jAoJnvcvcvcsdsxXUtOLZOd5feXffuMK3maR-IZn9ex-TJa9OcyByjIgNE3phjI7etEBUVikm8sqsdsdMBbPZlD4L3nwi8cJzbmVHvMlMg-SnvgHUFysgJcWbd8yFnbE5rCLgoSm7_815thz5pdsds343I4cFl5DSFs9ystLhOUFLafTEhFNzIpCydsddddrX4Aospm4FlYtAaw7_attvkejfMSZTLDhv1P1SkyeoHta-FBJ_Qne9nuwmio2g8Hk9nvAt4X9XMMbM4ojOR0ZWKX8MajwBZ0V5sF32I9VahBjtSj_VEEw8HtQDo0qqEvS9jjkkXjZtWbsr; JSESSIONID=D5fhd3yJ_GN03YjMHwQbYKWA_tVrMVNsVgAERSwRZ8b95sJtfU0i!-737431758; _WL_AUTHCOOKIE_JSESSIONID=3mPoRlL9DGnD4CsX18KA; __utmt=dfdf; __utma=46565656753.645342343563650653.1464071598.18; __utmb=9356534281.2.9.1464071600882; __utmc=93568581; __utmz=93568581.1458797007.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none) "https://xyz/....../xyz/xyz/"
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...