Splunk Enterprise

Apache access logs stored on a s3 bucket access

Said75015
Explorer

Hi

I have configured Splunk AWS plugin to get files stored in a s3 bucket. These files come from a Apache server and have Apache access log format. 

I use an s3 generic input and it seems to be connected (I tried with only one file) but when I check for searching events I don't see anything ? Internal Splunk logs indicate the s3 bucket is well reached and the file inside well processed without error.

Do you have a idea  from which this issue can be due ?

Thanks

Saïd

Labels (1)
0 Karma
1 Solution

Said75015
Explorer

Hi @venkatasri 

I have found the issue, it was just due to the fact that I used a too recent time interval (my records concerned an older time) so there was nothing displayed.

Thanks

View solution in original post

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @Said75015 

Can you share how your inputs have been configured? You can anonymize the bucket name.

 

Said75015
Explorer

Hi @venkatasri 

I have found the issue, it was just due to the fact that I used a too recent time interval (my records concerned an older time) so there was nothing displayed.

Thanks

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...