Getting Data In

How to parse Apache access logs in Splunk

snehalk
Communicator

Hello All,

We have the Apache access.log and am not able to parse it, first i used the "access_combined_wcookie" standard sourcetype but it wont work and am tried the tranforms.conf and props.conf file its parsing all filed except Cookies because it has the multiple value and my delimiter is Space( ).

%t %T %O %I %{X-Forwarded-For} %a %A %u %m %s \"%r\" %U %q \"%{User-Agent}i\" Cookies cs_referer 

Could you please help me on this?

Thanks in advance

jmallorquin
Builder

Hi,

Have you try use this?

https://splunkbase.splunk.com/app/3186/#/overview

Hope i help you

0 Karma

snehalk
Communicator

Hello Team,

Could you please any one help me on this?

0 Karma

jmallorquin
Builder

Hi,

Have you try use this?

https://splunkbase.splunk.com/app/3186/#/overview

Hope i help you

0 Karma

rafamss
Contributor

Hi snehalk,

Your file have a delimeter for this fields or your files always is delimeted by default ?

0 Karma

snehalk
Communicator

Hello Rafamss,

Here is transforms.conf file

[my_extract]
DELIMS = " "
FIELDS =%t %T %O %I %{X-Forwarded-For} %a %A %u %m %s \"%r\" %U %q \"%{User-Agent}i\" Cookies cs_referer 
0 Karma

jkat54
SplunkTrust
SplunkTrust

It appears you have "custom" apache logs. Please post an example of your apache access logs so we can help you.

0 Karma

snehalk
Communicator

Hello Jkat54,

Thanks for response, below is my log sample

[24/May/2016:02:33:20 -0400] 0 29045 1653 10.46.33.75 10.2.167.212 10.3.66.215 - GET 200 "GET /xyz/xyz/……../Home.jspx?_adddsdf.ctrl-state=14tsxsdsdseozt9_4&Adf-Rich-Message=true&unique=15353471600889&oracle.adf.view.rich.STREAM=temp:r1:0:t1&javax.faces.ViewState=!61ilzjmjl HTTP/1.1" /xyz/xyz/……../Home.jspx ?_adf.ctrl-state=14tsxeozt9_4&Adf-Rich-Message=true&unique=1464071600889&oracle.adf.view.rich.STREAM=temp:r1:0:t1&javax.faces.ViewState=!61ilzjmjl "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36" BlueStripe.PVN=e5667777; fkdfdkfd_dfd_dfd_df.app~dfff_fsd_sfsf_sfffs_pool=3611427594.24862.0000; qPRDSPOpenToken=T1RLAQKDuOytNwUp2Lua3o7WO_zuZRQjlBAsPUuHuSN-3x-Xcnj8g3EQAADwDV4Is9BgXuQT9jAoJnvcvcvcsdsxXUtOLZOd5feXffuMK3maR-IZn9ex-TJa9OcyByjIgNE3phjI7etEBUVikm8sqsdsdMBbPZlD4L3nwi8cJzbmVHvMlMg-SnvgHUFysgJcWbd8yFnbE5rCLgoSm7_815thz5pdsds343I4cFl5DSFs9ystLhOUFLafTEhFNzIpCydsddddrX4Aospm4FlYtAaw7_attvkejfMSZTLDhv1P1SkyeoHta-FBJ_Qne9nuwmio2g8Hk9nvAt4X9XMMbM4ojOR0ZWKX8MajwBZ0V5sF32I9VahBjtSj_VEEw8HtQDo0qqEvS9jjkkXjZtWbsr; JSESSIONID=D5fhd3yJ_GN03YjMHwQbYKWA_tVrMVNsVgAERSwRZ8b95sJtfU0i!-737431758; _WL_AUTHCOOKIE_JSESSIONID=3mPoRlL9DGnD4CsX18KA; __utmt=dfdf; __utma=46565656753.645342343563650653.1464071598.18; __utmb=9356534281.2.9.1464071600882; __utmc=93568581; __utmz=93568581.1458797007.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none) "https://xyz/....../xyz/xyz/"
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...