All Apps and Add-ons

Splunk Add-on for Apache vs pretrained sourcetypes

satyenshah
Path Finder

Is the Apache Add-on falling out of favor?

  1. It hasn't been updated since 1.0.0 release
  2. It doesn't officially support 7.3 or 8.0 (though unofficially it works fine)
  3. Splunk can natively parse apache logs using the access_combined and apache_error pretrained sourcetypes
  4. If you need more thorough CIM mapping than the pretrained sourcetypes offer, then there's an unofficial 'Add-on for Access Combined' available on splunkbase that does the job with fewer field extractions than the Apache add-on, and without the need for another sourcetype
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.