splunk wont recognize apache access logs

[tven7]

I tried to force the sourcetype to access_combined. Even then i do not see the field extractions related to apache log fields. Is there any reason why this would be failing?

[advaitk]

responding late since i ran into this and was left scratching my help.
so hopefully this helps someone else.
you have to very careful with the source data format (what is being logged in the log files by the web server).
in my case, i was using a CustomLog configuration in Apache, and using an unused field (%l - Remote logname), with some request header value but was double quoting the value.
splunk wasn't quite liking that, once i removed the double quotes, splunk loved it.

[tven7]

I set the access_combined in inputs.conf under deployment-apps and restarted the deployment server to propogate to the forwarders.

path is
/data/splunkdeployment/splunk/etc/deployment-apps/liferayProdApp/local

[lguinn2]

Can you post the actual stanza that you are using? Can you verify that the inputs.conf was actually propogated to the forwarders?