Getting Data In

 


Apache logs - local

NOTE - Splunk version 4.x reached its End of Life on October 1, 2013. Please see the migration information.

Apache logs - local

To get data from Apache web server logs into Splunk, point Splunk at a file, or a directory containing Apache logs:

1. From the Home page in Splunk Web, click Add data.

2. Under the To get started... banner, click Apache logs.

3. Click Next under Consume Apache logs on this Splunk server.

4. On the Get data from files and directories page, specify the source of the data by clicking on one of the three available choices.

5. In the Source field, enter the path to the file or directory you want Splunk to monitor:

You can usually leave the other fields blank, including the fields under the More settings option. Look here for detailed information on those fields.

6. Click Save.

7. From the Success page, click Search to start searching. You can enter any term that’s in your data, or you can click on a source, source type or host to see data from the different directories within your Apache log directory, the different types of data in those directories, or the different hosts that sent the Apache log data in the first place.

For more information on getting data from files and directories, see "Monitor files and directories" in this manual.

This documentation applies to the following versions of Splunk: 4.2 , 4.2.1 , 4.2.2 , 4.2.3 , 4.2.4 , 4.2.5 , 4.3 , 4.3.1 , 4.3.2 , 4.3.3 , 4.3.4 , 4.3.5 , 4.3.6 , 4.3.7 , 5.0 , 5.0.1 , 5.0.2 , 5.0.3 , 5.0.4 , 5.0.5 , 5.0.6 , 5.0.7 , 5.0.8 , 5.0.9 , 6.0 , 6.0.1 , 6.0.2 , 6.0.3 , 6.0.4 , 6.0.5 , 6.1 , 6.1.1 , 6.1.2 View the Article History for its revisions.


Comments

What about showing how to graph some access combined parameters?

Splunk zen
July 26, 2013

Hi Leegee,

You can upload each file manually. See http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitorfilesanddirectories for additional information.

Malmoore, Splunker
February 22, 2013

How can I consume logs once — ie. import historical logs?

TIA,
lee@15gifts.com

Leegee
February 20, 2013

You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!