httpd.conf configuration for logging recommendation?

[daniel333]

All,

We have legacy servers going years back and newer ones etc. Basically, we have ended up with about 30 different settings in httpd.conf for logging. They asked me what I want the standard to be for Splunk reasons. Started to think about that, and is there any reason why I shouldn't directly ask for CIM friendly key value pairs rights now in the source?

LogFormat

%t src_ip=%h RemoteLogName=%l RemoteUser=%u request=\"%r\" %>s %b \"%{Referer}i\" http_user_agent=\"%{User-Agent}i\"

Example:

[17/Aug/2016:20:20:27 -0400] src_ip=192.168.1.47 RemoteLogName=- RemoteUser=- request="GET /default.html HTTP/1.1" 304 - "-" http_user_agent="Mozilla/5.0 (Macintosh; Inte....

[ddrillic]

If you have this "luxury" you can try to conform your data to the Splunk industry standard one from - List of pretrained source types

This can be pretty cheerful if you manage to do it - one of my dreams in my current place ; - )