Refine your search:

It turns out that all the "definitions" required for web intelligence to work are not available and have to create them manually.

I do wonder about this... Is it access_common/access_combined or access-common/access-combined ??

asked 19 Jan '12, 07:30

heinrich.piard's gravatar image

heinrich.piard
11
accept rate: 0%

edited 19 Jan '12, 08:08

araitz's gravatar image

araitz ♦
7.9k3925


One Answer:

The most common sourcetypes are:

  • sourcetype=access_common (for Apache access logs)
  • sourcetype=access_combined (for Apache access logs)
  • sourcetype=iis* (for Microsoft IIS logs)
link

answered 19 Jan '12, 08:10

araitz's gravatar image

araitz ♦
7.9k3925
accept rate: 46%

Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×26

Asked: 19 Jan '12, 07:30

Seen: 882 times

Last updated: 19 Jan '12, 08:10

Copyright © 2005-2012 Splunk Inc. All rights reserved.