Splunk Search

Fields extraction from access log

pavan_bhumanapa
New Member

I would like to list below log in 8 parts and I'm not sure how to do it in with Regex. Please help me

{Field 1]       {Field 2  }   {Field 3]             [field 4] [field5]   [field6] [field 7][field 8} 
10.16.124.34 - pavan kumar [09/Aug/2011:11:15:11 -0500] "GET /sbconsole/ HTTP/1.1" 302      355 
0 Karma

lguinn2
Legend

If this is an Apache access log, you could simply assign it one of the Apache sourcetypes when you index it:

access_combined would probably work, but access_combined_wcookie might also be an option.

Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...