Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Search-time field extraction - Apache access_c...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a custom log format that is Apache's access_combined format with a custom field representing an app's version number at the end. The fields are space separated. How can I configure Splunk to do automatic search-time field extraction of the standard access_combined set of fields and this extra field?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You have two choices:
- Assign the source type of
access_combinedand inprops.conf, add a field for the version number. (An example of the field extraction is below.) This should work even if you have other logs that are the "standard"access_combinedformat, since the field won't be extracted where it doesn't exist. - Find the definition of
access_combinedin the defaultprops.confand copy it to your ownprops.conf, giving the stanza a different name. Then add the app version field.
Here is the field extraction for the the new field, which I call app_version (because the Apache logs already have a field named version which is the Apache version).
EXTRACT-e1 = \s(?<app_version>\S+)\s*$
This field will contain the last non-blank character string on the line.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You have two choices:
- Assign the source type of
access_combinedand inprops.conf, add a field for the version number. (An example of the field extraction is below.) This should work even if you have other logs that are the "standard"access_combinedformat, since the field won't be extracted where it doesn't exist. - Find the definition of
access_combinedin the defaultprops.confand copy it to your ownprops.conf, giving the stanza a different name. Then add the app version field.
Here is the field extraction for the the new field, which I call app_version (because the Apache logs already have a field named version which is the Apache version).
EXTRACT-e1 = \s(?<app_version>\S+)\s*$
This field will contain the last non-blank character string on the line.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
May 2026 Splunk Expert Sessions: Security & Observability
Network to App: Observability Unlocked [May & June Series]
SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...
