Data Source: Apache Access Log

Created: 2026-10-22

Last Updated: 2026-10-23

ID: 6ea32d4e-e6d0-4ceb-88d0-2b640457c894

Author: Nasreddine Bencherchali, Raven Tait, Splunk

Description

Apache HTTP Server access log events including client address, request method, URI, response status, and response size.

Details

Property	Value
Source	`/var/log/apache2/access.log`
Sourcetype	`apache:access:combined`

Name ▲▼	Technique ▲▼	Type ▲▼
PHP Worker Segmentation Fault After Multipart POST	Exploit Public-Facing Application	Anomaly

Supported Apps

Splunk Add-on for Apache Web Server (version 3.0.0)

Event Fields

+ Fields

  <span class="pill kill-chain">_time</span>
  
  <span class="pill kill-chain">action</span>
  
  <span class="pill kill-chain">bytes</span>
  
  <span class="pill kill-chain">bytes_in</span>
  
  <span class="pill kill-chain">bytes_out</span>
  
  <span class="pill kill-chain">client</span>
  
  <span class="pill kill-chain">http_method</span>
  
  <span class="pill kill-chain">http_referrer</span>
  
  <span class="pill kill-chain">http_referrer_domain</span>
  
  <span class="pill kill-chain">http_user_agent</span>
  
  <span class="pill kill-chain">http_user_agent_length</span>
  
  <span class="pill kill-chain">http_version</span>
  
  <span class="pill kill-chain">logname</span>
  
  <span class="pill kill-chain">request</span>
  
  <span class="pill kill-chain">request_bytes</span>
  
  <span class="pill kill-chain">src</span>
  
  <span class="pill kill-chain">status</span>
  
  <span class="pill kill-chain">status_description</span>
  
  <span class="pill kill-chain">status_type</span>
  
  <span class="pill kill-chain">timestamp</span>
  
  <span class="pill kill-chain">uri_path</span>
  
  <span class="pill kill-chain">uri_query</span>
  
  <span class="pill kill-chain">url</span>
  
  <span class="pill kill-chain">user</span>
  
  <span class="pill kill-chain">vendor_product</span>
  
</div>

Example Log

1198.51.100.3 - - [21/Oct/2026:23:22:28 +0000] "GET /vuln.php?page=/var/lib/php2shell-lab/sessions/sess_example HTTP/1.1" 200 604 "-" "-"

Required Output Fields

src
http_method
url
status

Source: GitHub | Version: 2