I locally index data from apache server.
I can see events for search sourcetype="access_*" and field extraction works but no data in all reports.
Any Ideas?
Thanks
Andrey
And you set "Specify log sources" in step 3 of the App setup to sourcetype=access_* ?
try index=
yes i setup to access_combined