https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-TA-Windows-Exchange-IIS-vs-sourcetype-IIS/m-p/323085#M38686 <P>Hello,<BR /> I have the Splunk App for Exchange but Splunk documentation is unclear on how to handle my situation.<BR /> I have servers with IIS and thus IIS logs, so my generic ALL-WINDOWS server class detects the IIS logs and sets the sourcetype=iis so that all the fields get parsed properly. </P> <P>The Splunk TA for Exchange IIS is here but obviously my Exchange_IIS Serverclass is lesser precedence. Regardless, it doesnt make sense that TA-Windows-Exchange-IIS sets sourcetype=MSWindows:2008R2:IIS when it misses out on the dynamic IIS log parsing. </P> <P>How can I make all the Exchange dashboards properly populate using sourcetype=iis? </P> Mon, 22 Jan 2018 16:49:12 GMT BP9906 2018-01-22T16:49:12Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-TA-Windows-Exchange-IIS-vs-sourcetype-IIS/m-p/323085#M38686 <P>Hello,<BR /> I have the Splunk App for Exchange but Splunk documentation is unclear on how to handle my situation.<BR /> I have servers with IIS and thus IIS logs, so my generic ALL-WINDOWS server class detects the IIS logs and sets the sourcetype=iis so that all the fields get parsed properly. </P> <P>The Splunk TA for Exchange IIS is here but obviously my Exchange_IIS Serverclass is lesser precedence. Regardless, it doesnt make sense that TA-Windows-Exchange-IIS sets sourcetype=MSWindows:2008R2:IIS when it misses out on the dynamic IIS log parsing. </P> <P>How can I make all the Exchange dashboards properly populate using sourcetype=iis? </P> Mon, 22 Jan 2018 16:49:12 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-TA-Windows-Exchange-IIS-vs-sourcetype-IIS/m-p/323085#M38686 BP9906 2018-01-22T16:49:12Z