Hi,
I am planning to index one of the access.log file. which has data like below first line header and next two lines two example data.
"time_stamp" "auth_user" src_ip status_code "req_line" "categories" "rep_level" "media_type" bytes_to_client bytes_from_client "user_agent" "virus_name" "block_res" "application_name"
[29/Mar/2019:06:04:57 +0530] "" 176.6.60.56 403 "GET http://abcd.com/HTTP/1.1"; "Software/Hardware" "Minimal Risk" "" 8811 237 "Microsoft-CryptoAPI/6.1" "" "0" ""
[29/Mar/2019:06:04:57 +0530] "asharma072315" 176.6.50.55 200 "POST https://obdefw.com/HTTP/1.1"; "Web Mail" "Minimal Risk" "" 1208 7687 "Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.9126; Pro)" "" "0" ""
But while trying to inidex it splunk says time format is incorrect/invalid.
Can you please suggest the props.conf and transforms.conf for this log file.
in my inputs.conf i have mentioned something like this:
[monitor:///appname/lookups/*]
disabled = 1
source_type = accesslog
index = accesslog
