Getting Data In

How to parse Apache access logs in Splunk

snehalk
Communicator

Hello All,

We have the Apache access.log and am not able to parse it, first i used the "access_combined_wcookie" standard sourcetype but it wont work and am tried the tranforms.conf and props.conf file its parsing all filed except Cookies because it has the multiple value and my delimiter is Space( ).

%t %T %O %I %{X-Forwarded-For} %a %A %u %m %s \"%r\" %U %q \"%{User-Agent}i\" Cookies cs_referer 

Could you please help me on this?

Thanks in advance

jmallorquin
Builder

Hi,

Have you try use this?

https://splunkbase.splunk.com/app/3186/#/overview

Hope i help you

0 Karma

snehalk
Communicator

Hello Team,

Could you please any one help me on this?

0 Karma

jmallorquin
Builder

Hi,

Have you try use this?

https://splunkbase.splunk.com/app/3186/#/overview

Hope i help you

0 Karma

rafamss
Contributor

Hi snehalk,

Your file have a delimeter for this fields or your files always is delimeted by default ?

0 Karma

snehalk
Communicator

Hello Rafamss,

Here is transforms.conf file

[my_extract]
DELIMS = " "
FIELDS =%t %T %O %I %{X-Forwarded-For} %a %A %u %m %s \"%r\" %U %q \"%{User-Agent}i\" Cookies cs_referer 
0 Karma

jkat54
SplunkTrust
SplunkTrust

It appears you have "custom" apache logs. Please post an example of your apache access logs so we can help you.

0 Karma

snehalk
Communicator

Hello Jkat54,

Thanks for response, below is my log sample

[24/May/2016:02:33:20 -0400] 0 29045 1653 10.46.33.75 10.2.167.212 10.3.66.215 - GET 200 "GET /xyz/xyz/……../Home.jspx?_adddsdf.ctrl-state=14tsxsdsdseozt9_4&Adf-Rich-Message=true&unique=15353471600889&oracle.adf.view.rich.STREAM=temp:r1:0:t1&javax.faces.ViewState=!61ilzjmjl HTTP/1.1" /xyz/xyz/……../Home.jspx ?_adf.ctrl-state=14tsxeozt9_4&Adf-Rich-Message=true&unique=1464071600889&oracle.adf.view.rich.STREAM=temp:r1:0:t1&javax.faces.ViewState=!61ilzjmjl "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36" BlueStripe.PVN=e5667777; fkdfdkfd_dfd_dfd_df.app~dfff_fsd_sfsf_sfffs_pool=3611427594.24862.0000; qPRDSPOpenToken=T1RLAQKDuOytNwUp2Lua3o7WO_zuZRQjlBAsPUuHuSN-3x-Xcnj8g3EQAADwDV4Is9BgXuQT9jAoJnvcvcvcsdsxXUtOLZOd5feXffuMK3maR-IZn9ex-TJa9OcyByjIgNE3phjI7etEBUVikm8sqsdsdMBbPZlD4L3nwi8cJzbmVHvMlMg-SnvgHUFysgJcWbd8yFnbE5rCLgoSm7_815thz5pdsds343I4cFl5DSFs9ystLhOUFLafTEhFNzIpCydsddddrX4Aospm4FlYtAaw7_attvkejfMSZTLDhv1P1SkyeoHta-FBJ_Qne9nuwmio2g8Hk9nvAt4X9XMMbM4ojOR0ZWKX8MajwBZ0V5sF32I9VahBjtSj_VEEw8HtQDo0qqEvS9jjkkXjZtWbsr; JSESSIONID=D5fhd3yJ_GN03YjMHwQbYKWA_tVrMVNsVgAERSwRZ8b95sJtfU0i!-737431758; _WL_AUTHCOOKIE_JSESSIONID=3mPoRlL9DGnD4CsX18KA; __utmt=dfdf; __utma=46565656753.645342343563650653.1464071598.18; __utmb=9356534281.2.9.1464071600882; __utmc=93568581; __utmz=93568581.1458797007.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none) "https://xyz/....../xyz/xyz/"
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...