Getting Data In

How to parse Apache access logs in Splunk

snehalk
Communicator

Hello All,

We have the Apache access.log and am not able to parse it, first i used the "access_combined_wcookie" standard sourcetype but it wont work and am tried the tranforms.conf and props.conf file its parsing all filed except Cookies because it has the multiple value and my delimiter is Space( ).

%t %T %O %I %{X-Forwarded-For} %a %A %u %m %s \"%r\" %U %q \"%{User-Agent}i\" Cookies cs_referer 

Could you please help me on this?

Thanks in advance

jmallorquin
Builder

Hi,

Have you try use this?

https://splunkbase.splunk.com/app/3186/#/overview

Hope i help you

0 Karma

snehalk
Communicator

Hello Team,

Could you please any one help me on this?

0 Karma

jmallorquin
Builder

Hi,

Have you try use this?

https://splunkbase.splunk.com/app/3186/#/overview

Hope i help you

0 Karma

rafamss
Contributor

Hi snehalk,

Your file have a delimeter for this fields or your files always is delimeted by default ?

0 Karma

snehalk
Communicator

Hello Rafamss,

Here is transforms.conf file

[my_extract]
DELIMS = " "
FIELDS =%t %T %O %I %{X-Forwarded-For} %a %A %u %m %s \"%r\" %U %q \"%{User-Agent}i\" Cookies cs_referer 
0 Karma

jkat54
SplunkTrust
SplunkTrust

It appears you have "custom" apache logs. Please post an example of your apache access logs so we can help you.

0 Karma

snehalk
Communicator

Hello Jkat54,

Thanks for response, below is my log sample

[24/May/2016:02:33:20 -0400] 0 29045 1653 10.46.33.75 10.2.167.212 10.3.66.215 - GET 200 "GET /xyz/xyz/……../Home.jspx?_adddsdf.ctrl-state=14tsxsdsdseozt9_4&Adf-Rich-Message=true&unique=15353471600889&oracle.adf.view.rich.STREAM=temp:r1:0:t1&javax.faces.ViewState=!61ilzjmjl HTTP/1.1" /xyz/xyz/……../Home.jspx ?_adf.ctrl-state=14tsxeozt9_4&Adf-Rich-Message=true&unique=1464071600889&oracle.adf.view.rich.STREAM=temp:r1:0:t1&javax.faces.ViewState=!61ilzjmjl "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36" BlueStripe.PVN=e5667777; fkdfdkfd_dfd_dfd_df.app~dfff_fsd_sfsf_sfffs_pool=3611427594.24862.0000; qPRDSPOpenToken=T1RLAQKDuOytNwUp2Lua3o7WO_zuZRQjlBAsPUuHuSN-3x-Xcnj8g3EQAADwDV4Is9BgXuQT9jAoJnvcvcvcsdsxXUtOLZOd5feXffuMK3maR-IZn9ex-TJa9OcyByjIgNE3phjI7etEBUVikm8sqsdsdMBbPZlD4L3nwi8cJzbmVHvMlMg-SnvgHUFysgJcWbd8yFnbE5rCLgoSm7_815thz5pdsds343I4cFl5DSFs9ystLhOUFLafTEhFNzIpCydsddddrX4Aospm4FlYtAaw7_attvkejfMSZTLDhv1P1SkyeoHta-FBJ_Qne9nuwmio2g8Hk9nvAt4X9XMMbM4ojOR0ZWKX8MajwBZ0V5sF32I9VahBjtSj_VEEw8HtQDo0qqEvS9jjkkXjZtWbsr; JSESSIONID=D5fhd3yJ_GN03YjMHwQbYKWA_tVrMVNsVgAERSwRZ8b95sJtfU0i!-737431758; _WL_AUTHCOOKIE_JSESSIONID=3mPoRlL9DGnD4CsX18KA; __utmt=dfdf; __utma=46565656753.645342343563650653.1464071598.18; __utmb=9356534281.2.9.1464071600882; __utmc=93568581; __utmz=93568581.1458797007.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none) "https://xyz/....../xyz/xyz/"
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...