splunkd_ui_access logs

[Abass42]

Im trying to create some dashboards to make reading _internal logs easier. I'm trying to figure out what all for the fields we are getting in are. This Splunk Doc has the gist of what I am looking at, but we have more fields than that. 

Abass42_0-1722635298465.png

In the doc it mentions something about apache and its logs, and whereas we do use apache, im not well versed in it enough to understand what i was looking at fully. I think we are adding in extracted fields, or adding in values in the processing that Splunk does. How can i track down what .conf file is adding the fields. Id like to have a better understanding of where these values come from. There are a lot more fields than the _raw logs seem to have. Like metadata. 

[ITWhisperer]

Which exact fields are you interested in?

[yuanliu]

The document is saying that the splunkd_ui_access.log uses the Apache access.log common format.  So, the same extraction is applied.  It is unrelated to your use of Apache httpd.

If you have more fields, you need to illustrate your data and point out where additional information can be extracted.