Splunk Search

splunk 4.1.4 not transforming an apache access log

beezly
Explorer

I have a Splunk 4.1.4 install which is indexing some apache access logs. Unfortunately, when I try to produce reports on the logs, it doesn't seem to have done the fields transform so all the url, useragent, etc fields are missing.

The weird thing is, in the fields column on the left hand side of the search view, it says "All 68 fields" but if I click that to add more fields, the dialog box that appears says "Available fields (24)".

The initial query I did was;

host="gromit" sourcetype="access_combined"

The entry for the field transform seems to be there in /opt/splunk/etc/system/default;

REGEX = ^[[nspaces:clientip]]\s++[[nspaces:ident]]\s++[[nspaces:user]]\s++[[sbstring:req_time]]\s++[[access-request]]\s++[[nspaces:status]]\s++[[nspaces:bytes]](?:\s++"(?<referer>[[bc_domain:referer_]]?+[^"]*+)"(?:\s++[[qstring:useragent]](?:\s++[[qstring:cookie]])?+)?+)?[[all:other]]

Am I doing something wrong?

Tags (2)
0 Karma

jeffwarn
Explorer

I'm seeing a similar issue on some of my logs. I have things set to auto detect in a directory watch and I come up with 2 types:

access-too_small:

10.253.1.1 - - [14/Mar/2011:09:33:22 -0400] default - "GET / HTTP/1.0" 200 5127 "-" "-"

access-6:

192.168.1.1 - - [14/Mar/2011:09:36:02 -0400] pub.mydomain.com url.someotherdomain.com "POST /path/to/java HTTP/1.1" 200 318 "-" "Mozilla/4.0 (Windows XP 5.1) Java/1.6.0_24"

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

Could you add an (anonymized) log like so that we can see why it might not be extracting?

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...