Splunk Enterprise Security

Where is the tag for out of the box Apache logs? I need it for the Splunk Enterprise Security app

coleman07
Path Finder

Apache log data has out of the box sourcetypes, but no tag file to associate a tag of web to Apache log entries and I can't find an add-on which defines all the extractions for Apache logs. This is important because the Enterprise Security App uses that tag to store web data into the proper data model. How have other ES users dealt with Apache log data? Is there an add-on for Apache or a default file to define the web tag for Apache web servers?

0 Karma

jkat54
SplunkTrust
SplunkTrust

Did you mean the "tag" in splunk? If so you create your own tags so you should be able to define your own as needed.

http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/Defineandusetags

http://docs.splunk.com/Documentation/Splunk/6.1/knowledge/Abouttagsandaliases

0 Karma

coleman07
Path Finder

I wanted to be sure that I wasn't missing something inside Splunk since I can't be the first ES user who has to create a tag in order for ES to work with Apache data. Splunk must have something.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...