Splunk Enterprise

Apache access logs stored on a s3 bucket access

Said75015
Explorer

Hi

I have configured Splunk AWS plugin to get files stored in a s3 bucket. These files come from a Apache server and have Apache access log format. 

I use an s3 generic input and it seems to be connected (I tried with only one file) but when I check for searching events I don't see anything ? Internal Splunk logs indicate the s3 bucket is well reached and the file inside well processed without error.

Do you have a idea  from which this issue can be due ?

Thanks

Saïd

Labels (1)
0 Karma
1 Solution

Said75015
Explorer

Hi @venkatasri 

I have found the issue, it was just due to the fact that I used a too recent time interval (my records concerned an older time) so there was nothing displayed.

Thanks

View solution in original post

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @Said75015 

Can you share how your inputs have been configured? You can anonymize the bucket name.

 

Said75015
Explorer

Hi @venkatasri 

I have found the issue, it was just due to the fact that I used a too recent time interval (my records concerned an older time) so there was nothing displayed.

Thanks

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>