Hi i have raw data like this:
192.0.100.3 - - [30/Jul/2019:00:06:05 -0500] "GET /test/ HTTP/1.1" 403 207 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36"
clientip = 192.0.200.2 host = cliente uri = /test/ useragent = Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36
and i need ectract IP , Time ,User Agent , and URL help please, its a logs from apache
Have you tried using default 'access_combined' sourcetype ?
https://docs.splunk.com/Documentation/Splunk/7.3.0/Data/Listofpretrainedsourcetypes
if the sourcetype not available, try below add-on(Add-on for Access Combined) -
https://splunkbase.splunk.com/app/3434/
@miguelebf
Can you accept the answer if it's helped you? Thanks.