Splunk Search

Extract Fields Apache Logs

miguelebf
New Member

Hi i have raw data like this:
192.0.100.3 - - [30/Jul/2019:00:06:05 -0500] "GET /test/ HTTP/1.1" 403 207 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36"
clientip = 192.0.200.2 host = cliente uri = /test/ useragent = Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

and i need ectract IP , Time ,User Agent , and URL help please, its a logs from apache

Tags (1)
0 Karma

jawaharas
Motivator

Have you tried using default 'access_combined' sourcetype ?
https://docs.splunk.com/Documentation/Splunk/7.3.0/Data/Listofpretrainedsourcetypes

if the sourcetype not available, try below add-on(Add-on for Access Combined) -
https://splunkbase.splunk.com/app/3434/

0 Karma

jawaharas
Motivator

@miguelebf
Can you accept the answer if it's helped you? Thanks.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...