Splunk Enterprise

Apache access logs stored on a s3 bucket access

Said75015
Explorer

Hi

I have configured Splunk AWS plugin to get files stored in a s3 bucket. These files come from a Apache server and have Apache access log format. 

I use an s3 generic input and it seems to be connected (I tried with only one file) but when I check for searching events I don't see anything ? Internal Splunk logs indicate the s3 bucket is well reached and the file inside well processed without error.

Do you have a idea  from which this issue can be due ?

Thanks

Saïd

Labels (1)
0 Karma
1 Solution

Said75015
Explorer

Hi @venkatasri 

I have found the issue, it was just due to the fact that I used a too recent time interval (my records concerned an older time) so there was nothing displayed.

Thanks

View solution in original post

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @Said75015 

Can you share how your inputs have been configured? You can anonymize the bucket name.

 

Said75015
Explorer

Hi @venkatasri 

I have found the issue, it was just due to the fact that I used a too recent time interval (my records concerned an older time) so there was nothing displayed.

Thanks

0 Karma
Get Updates on the Splunk Community!

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...

Splunk Observability Cloud | Enhancing Your Onboarding Experience with the ...

We understand that your initial experience with getting data into Splunk Observability Cloud is crucial as it ...