Where is the tag for out of the box Apache logs? I need it for the Splunk Enterprise Security app

[coleman07]

Apache log data has out of the box sourcetypes, but no tag file to associate a tag of web to Apache log entries and I can't find an add-on which defines all the extractions for Apache logs. This is important because the Enterprise Security App uses that tag to store web data into the proper data model. How have other ES users dealt with Apache log data? Is there an add-on for Apache or a default file to define the web tag for Apache web servers?

[jkat54]

Did you mean the "tag" in splunk? If so you create your own tags so you should be able to define your own as needed.

http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/Defineandusetags

http://docs.splunk.com/Documentation/Splunk/6.1/knowledge/Abouttagsandaliases

[coleman07]

I wanted to be sure that I wasn't missing something inside Splunk since I can't be the first ES user who has to create a tag in order for ES to work with Apache data. Splunk must have something.