Community:Field extractions for Squid data

Courtesty of Rui Ataide in this forum posting:

http://www.splunk.com/support/forum:SplunkApplications/3973/13053#post

Field extractions for Squid:

props.conf

[squid]
TIME_FORMAT = %3N
MAX_TIMESTAMP_LOOKAHEAD = 15
SHOULD_LINEMERGE = false
REPORT-squid = squid

transforms.conf

[squid]
REGEX = ^\d+\.\d+\s+(\d+)\s+([0-9\.]*)\s+([^/]+)/(\d+)\s+(\d+)\s+(\w+)\s+((?:([^:]*)://)?([^/:]+):?(\d+)?/?([^ ]*))\s+(\S+)\s+([^/]+)/([^ ]+)\s+(.*)$
FORMAT = duration::$1 clientip::$2 action::$3 http_status::$4 bytes::$5 method::$6 uri::$7 proto::$8 uri_host::$9 uri_port::$10 uri_path::$11 username::$12 hierarchy::$13 server_ip::$14 content_type::$15