Splunk Dev

Web Intelligence for apache logs

heinrich_piard
New Member

What is the log format Web Intelligence app expects apache log files in? This is how I have setup the format but web intelligence does not show any data.

www.test.test.com 180.148.99.141 - - [13/Jan/2012:13:55:09 -0500] "GET /portlets/current_news.json?BLOCKSIZE=30 HTTP/1.1" 200 15588 "-" "Jakarta Commons-HttpClient/3.1"0/194888
0 Karma

araitz
Splunk Employee
Splunk Employee

Per Splunk's default field extractions:

[access-extractions]
# matches access-common or access-combined apache logging formats
# Extracts: clientip, clientport, ident, user, req_time, method, uri, root, file, uri_domain, uri_query, version, status, bytes, referer_url, referer_domain, referer_proto, useragent, cookie, other (remaining chars)

Your logs seem formatted correctly, but perhaps you have not assigned them the sourcetype of "access_combined". What sourcetype do your Apache logs currently show?

heinrich_piard
New Member

[folded comment in to question - araitz]

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...