Splunk Enterprise Security

Where is the tag for out of the box Apache logs? I need it for the Splunk Enterprise Security app

coleman07
Path Finder

Apache log data has out of the box sourcetypes, but no tag file to associate a tag of web to Apache log entries and I can't find an add-on which defines all the extractions for Apache logs. This is important because the Enterprise Security App uses that tag to store web data into the proper data model. How have other ES users dealt with Apache log data? Is there an add-on for Apache or a default file to define the web tag for Apache web servers?

0 Karma

jkat54
SplunkTrust
SplunkTrust

Did you mean the "tag" in splunk? If so you create your own tags so you should be able to define your own as needed.

http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/Defineandusetags

http://docs.splunk.com/Documentation/Splunk/6.1/knowledge/Abouttagsandaliases

0 Karma

coleman07
Path Finder

I wanted to be sure that I wasn't missing something inside Splunk since I can't be the first ES user who has to create a tag in order for ES to work with Apache data. Splunk must have something.

0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...