Splunk Search
Highlighted

SplunkforSquid Logformat

Path Finder

Is there a specific logging format that I should set in the SplunkforSquid app to get the proper field extraction? I am running Squid 2.6 with the following logformat which does not seem to match up with the extractions in this app:

logformat squid  %ts.%03tu %6tr %>a %Ss/%03Hs %<st %rm %ru %un %Sh/%<A %mt
Tags (2)
Highlighted

Re: SplunkforSquid Logformat

Legend

Splunk for Squid assumes that the Squid access logs are in default format, which is what you seem to be using. Are you using sourcetype "squid"? Could you post a sample log event for troubleshooting?

Regards, Patrik

Highlighted

Re: SplunkforSquid Logformat

Path Finder

Hi Patrik, Here is an example of a sourcetype=squid search.
1293720507.168 322 10.163.4.75 TCPMISS/200 6631 CONNECT xmlrpc.rhn.redhat.com:443 - DIRECT/209.132.183.44 -
1293720553.568 488 10.7.0.13 TCP
MISS/200 4594 CONNECT update-manifests.ironport.com:443 - DIRECT/204.15.82.17 -
1293720553.589 17 10.7.0.13 TCP_MISS/200 9609 GET http://updates.ironport.com/ibrs/1.1/ip/ips1g/1293720247.inc - DIRECT/184.84.247.25 text/plain

0 Karma
Highlighted

Re: SplunkforSquid Logformat

Legend

Thank you. These events are formatted in a way that the field extractions handle, so my best guess would be that the sourcetype is something other than "squid" (as the field extractions only apply to this sourcetype). Could you please verify the sourcetype you're using?

0 Karma