Splunk Search

SplunkforSquid Logformat

imarks004
Path Finder

Is there a specific logging format that I should set in the SplunkforSquid app to get the proper field extraction? I am running Squid 2.6 with the following logformat which does not seem to match up with the extractions in this app:

logformat squid  %ts.%03tu %6tr %>a %Ss/%03Hs %<st %rm %ru %un %Sh/%<A %mt
Tags (2)

Ayn
Legend

Splunk for Squid assumes that the Squid access logs are in default format, which is what you seem to be using. Are you using sourcetype "squid"? Could you post a sample log event for troubleshooting?

Regards, Patrik

Ayn
Legend

Thank you. These events are formatted in a way that the field extractions handle, so my best guess would be that the sourcetype is something other than "squid" (as the field extractions only apply to this sourcetype). Could you please verify the sourcetype you're using?

0 Karma

imarks004
Path Finder

Hi Patrik, Here is an example of a sourcetype=squid search.
1293720507.168 322 10.163.4.75 TCP_MISS/200 6631 CONNECT xmlrpc.rhn.redhat.com:443 - DIRECT/209.132.183.44 -
1293720553.568 488 10.7.0.13 TCP_MISS/200 4594 CONNECT update-manifests.ironport.com:443 - DIRECT/204.15.82.17 -
1293720553.589 17 10.7.0.13 TCP_MISS/200 9609 GET http://updates.ironport.com/ibrs/1.1/ip/ips1g/1293720247.inc - DIRECT/184.84.247.25 text/plain

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...