Why is apache logs relevant field name not showing in details log?

[Jaycybersec]

Hello ,

I have installed forwarder on Linux system and able to see logs in searches but the when i open a detailed log the field & value is missing for the relevant part of raw log.

All the useful details are missing in field.

Ip address, status code, bytes, user agent name, method used etc.. are missing.

can anyone guide here how to see those relevant things inside events.

[richgalloway]

Have you installed an app to process the events for you?  Splunk Add-on for Apache Web Server (https://splunkbase.splunk.com/app/3186/) looks like a good candidate.  

[Jaycybersec]

Hi,

Thanks for your response.

Have installed the app and restarted the service but still unable to see those relevant fields.

[richgalloway]

The issue seems to stem, at least in part, from the sourcetype "access-too_small".  It's unlikely any add-on uses that sourcetype so none will extract any fields for it.

The "-too_small" issue usually arises when the input does not specify a sourcetype and there's not enough data for Splunk to analyze and make a guess about the sourcetype.  Make sure the inputs.conf file with the [monitor:///var/log/apache2/access.log] stanza has a sourcetype setting,

[Jaycybersec]

Hi,

i have done the suggested steps and it's working fine and showing the relevant field.

Thanks .

[richgalloway · Accepted solution]

Great!  If your problem is resolved, then please click the "Accept as Solution" button to help future readers.