SplunkforSquid Logformat

[imarks004]

Is there a specific logging format that I should set in the SplunkforSquid app to get the proper field extraction? I am running Squid 2.6 with the following logformat which does not seem to match up with the extractions in this app:

logformat squid  %ts.%03tu %6tr %>a %Ss/%03Hs %<st %rm %ru %un %Sh/%<A %mt

[Ayn]

Splunk for Squid assumes that the Squid access logs are in default format, which is what you seem to be using. Are you using sourcetype "squid"? Could you post a sample log event for troubleshooting?

Regards, Patrik

[Ayn]

Thank you. These events are formatted in a way that the field extractions handle, so my best guess would be that the sourcetype is something other than "squid" (as the field extractions only apply to this sourcetype). Could you please verify the sourcetype you're using?

[imarks004]

Hi Patrik, Here is an example of a sourcetype=squid search.
1293720507.168 322 10.163.4.75 TCP_MISS/200 6631 CONNECT xmlrpc.rhn.redhat.com:443 - DIRECT/209.132.183.44 -
1293720553.568 488 10.7.0.13 TCP_MISS/200 4594 CONNECT update-manifests.ironport.com:443 - DIRECT/204.15.82.17 -
1293720553.589 17 10.7.0.13 TCP_MISS/200 9609 GET http://updates.ironport.com/ibrs/1.1/ip/ips1g/1293720247.inc - DIRECT/184.84.247.25 text/plain