How to parse Apache access logs in Splunk

[snehalk]

Hello All,

We have the Apache access.log and am not able to parse it, first i used the "access_combined_wcookie" standard sourcetype but it wont work and am tried the tranforms.conf and props.conf file its parsing all filed except Cookies because it has the multiple value and my delimiter is Space( ).

%t %T %O %I %{X-Forwarded-For} %a %A %u %m %s \"%r\" %U %q \"%{User-Agent}i\" Cookies cs_referer 

Could you please help me on this?

Thanks in advance

[jmallorquin]

Hi,

Have you try use this?

https://splunkbase.splunk.com/app/3186/#/overview

Hope i help you

[snehalk]

Hello Team,

Could you please any one help me on this?

[jmallorquin]

Hi,

Have you try use this?

https://splunkbase.splunk.com/app/3186/#/overview

Hope i help you

[rafamss]

Hi snehalk,

Your file have a delimeter for this fields or your files always is delimeted by default ?

[snehalk]

Hello Rafamss,

Here is transforms.conf file

[my_extract]
DELIMS = " "
FIELDS =%t %T %O %I %{X-Forwarded-For} %a %A %u %m %s \"%r\" %U %q \"%{User-Agent}i\" Cookies cs_referer 

[jkat54]

It appears you have "custom" apache logs. Please post an example of your apache access logs so we can help you.

[snehalk]

Hello Jkat54,

Thanks for response, below is my log sample

[24/May/2016:02:33:20 -0400] 0 29045 1653 10.46.33.75 10.2.167.212 10.3.66.215 - GET 200 "GET /xyz/xyz/……../Home.jspx?_adddsdf.ctrl-state=14tsxsdsdseozt9_4&Adf-Rich-Message=true&unique=15353471600889&oracle.adf.view.rich.STREAM=temp:r1:0:t1&javax.faces.ViewState=!61ilzjmjl HTTP/1.1" /xyz/xyz/……../Home.jspx ?_adf.ctrl-state=14tsxeozt9_4&Adf-Rich-Message=true&unique=1464071600889&oracle.adf.view.rich.STREAM=temp:r1:0:t1&javax.faces.ViewState=!61ilzjmjl "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36" BlueStripe.PVN=e5667777; fkdfdkfd_dfd_dfd_df.app~dfff_fsd_sfsf_sfffs_pool=3611427594.24862.0000; qPRDSPOpenToken=T1RLAQKDuOytNwUp2Lua3o7WO_zuZRQjlBAsPUuHuSN-3x-Xcnj8g3EQAADwDV4Is9BgXuQT9jAoJnvcvcvcsdsxXUtOLZOd5feXffuMK3maR-IZn9ex-TJa9OcyByjIgNE3phjI7etEBUVikm8sqsdsdMBbPZlD4L3nwi8cJzbmVHvMlMg-SnvgHUFysgJcWbd8yFnbE5rCLgoSm7_815thz5pdsds343I4cFl5DSFs9ystLhOUFLafTEhFNzIpCydsddddrX4Aospm4FlYtAaw7_attvkejfMSZTLDhv1P1SkyeoHta-FBJ_Qne9nuwmio2g8Hk9nvAt4X9XMMbM4ojOR0ZWKX8MajwBZ0V5sF32I9VahBjtSj_VEEw8HtQDo0qqEvS9jjkkXjZtWbsr; JSESSIONID=D5fhd3yJ_GN03YjMHwQbYKWA_tVrMVNsVgAERSwRZ8b95sJtfU0i!-737431758; _WL_AUTHCOOKIE_JSESSIONID=3mPoRlL9DGnD4CsX18KA; __utmt=dfdf; __utma=46565656753.645342343563650653.1464071598.18; __utmb=9356534281.2.9.1464071600882; __utmc=93568581; __utmz=93568581.1458797007.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none) "https://xyz/....../xyz/xyz/"