×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
splunkmeuser
New Member
Member since: ‎08-01-2013
‎06-05-2020
Community Statistics
Posts 5
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎08-01-2013
Activity Feed
View All

Re: help with apache access searching

by in Splunk Search
‎08-07-2013 06:11 AM
‎08-07-2013 06:11 AM
im pretty sure my extractor (everything i posted in my original post) is not accurate. so i'm hoping you can provide the right regex/extractor that would solve my problem based on the log samples i provided. any ideas? ... View more

Re: help with apache access searching

by in Splunk Search
‎08-06-2013 09:24 AM
‎08-06-2013 09:24 AM
Here are two lines from my logs: 10.50.1.1 - - [06/Aug/2013:12:20:07 -0400] 19537 "GET /fetch/ext/load.js HTTP/1.1" 200 + 5149 365 5310 4011 "http://hs.garden.com/forum/load/appl/msg116.html" "Mozilla/5.0 (iPad; CPU OS 6_1_3 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10B329 Safari/8536.25" "ss.lototo.com" "-" "-" "-" "-" "-" 10.75.12.9 - - [06/Aug/2013:12:20:07 -0400] 19537 "GET /request/page/xml?path=%2Fcharlie-hunnam%2F1-k-42836&site==entertainment=0&is_xfinity= HTTP/1.1" 200 + 14891 414 15057 97443 "-" "-" "ss.lototo.com" "-" "-" "-" "-" "-" Please advise. ... View more

Re: help with apache access searching

by in Splunk Search
‎08-05-2013 02:40 PM
‎08-05-2013 02:40 PM
this is from the field extraction. i need to be able to make splunk recognize the custom format of my apache logs so that i can accurately get values from specific fields. this is needed because i need to be generating reports on the values of those fields. any help will be appreciated! ... View more

help with apache access searching

by in Splunk Search
‎08-05-2013 12:37 PM
‎08-05-2013 12:37 PM
LogFormat "%h %l %u %t %P \"%r\" %>s %X %b %I %O %D \"%{Referer}i\" \"%{User-Agent}i\" \"%{Host}i\" \"%{X-Forwarded-For}i\" \"%{X-Cluster-Client-IP}i\" \"%{True-Client-IP}i\" \"%{Via}i\" \"%{Akamai-Origin-Hop}i\"" combined what does the above translate to? my attempt was (which i'm sure is very wrong): ^[[nspaces:clientip]]\s++[[nspaces:ident]]\s++[[nspaces:user]]\s++[[sbstring:req_time]]\s++[[nspaces:processid]]\s++[[access-request]]\s++[[nspaces:status]]\s++[[nspaces:connectionstatus]]\s++[[nspaces:bytes_received]]\s++[[nspaces:bytes_sent]]\s++[[nspaces:timeus]]\s++[[qstring:referrer]]\s++[[qstring:useragent]]\s++[[qstring:hservername]]\s++[[qstring:xforwardedfor]]\s++[[qstring:xclusterclientip]]\s++[[qstring:trueclientip]]\s++[[qstring:via]]\s++[[qstring:akamaiorigin]] ... View more

FIELDNAME regex rex

by in Splunk Search
‎08-01-2013 02:00 PM
‎08-01-2013 02:00 PM
sourcetype="apache-access" | rex "(?i)\(.*?; (?P \w+)(?=/)" | top 100 FIELDNAME i'm using the above to get information about bots. how exactly can i modify the above to exclude certain bots???? i've tried: sourcetype="apache-access" | rex "(?i)\(.*?; (?P \w+)(?=/)" | top 100 FIELDNAME | where FIELDNAME!=Trident can someone please help me modify the above so it does exactly what i need. i just need to be able to exclude certain bots. ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:04 AM