Is the Apache Add-on falling out of favor?
1. It hasn't been updated since 1.0.0 release
2. It doesn't officially support 7.3 or 8.0 (though unofficially it works fine)
3. Splunk can natively parse apache logs using the *access_combined* and *apache_error* pretrained sourcetypes
4. If you need more thorough CIM mapping than the pretrained sourcetypes offer, then there's an unofficial 'Add-on for Access Combined' available on splunkbase that does the job with fewer field extractions than the Apache add-on, and without the need for another sourcetype
↧