Splunk Enterprise Security

Where is the tag for out of the box Apache logs? I need it for the Splunk Enterprise Security app

Communicator

Apache log data has out of the box sourcetypes, but no tag file to associate a tag of web to Apache log entries and I can't find an add-on which defines all the extractions for Apache logs. This is important because the Enterprise Security App uses that tag to store web data into the proper data model. How have other ES users dealt with Apache log data? Is there an add-on for Apache or a default file to define the web tag for Apache web servers?

0 Karma

SplunkTrust
SplunkTrust

Did you mean the "tag" in splunk? If so you create your own tags so you should be able to define your own as needed.

http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/Defineandusetags

http://docs.splunk.com/Documentation/Splunk/6.1/knowledge/Abouttagsandaliases

0 Karma

Communicator

I wanted to be sure that I wasn't missing something inside Splunk since I can't be the first ES user who has to create a tag in order for ES to work with Apache data. Splunk must have something.

0 Karma