https://community.splunk.com/t5/All-Apps-and-Add-ons/How-do-I-pull-SharePoint-logs-into-Splunk/m-p/446082#M54877 <P>It would be really beneficial to a lot of people to provide support for the on prem version SharePoint 2016 as not everyone is willing/ready to use the cloud version.</P> Thu, 09 Jan 2020 14:10:25 GMT bullbo 2020-01-09T14:10:25Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-do-I-pull-SharePoint-logs-into-Splunk/m-p/446079#M54874 <P>Hello Everyone ,</P> <P>Found some of the question and answer pairs related to pulling SharePoint logs into Splunk and the visualizations which are dated back 2010-12 … Can any one please help in figuring out the following?</P> <P>1)What are the basic steps that need to be done to pull SharePoint logs into the Splunk environment?<BR /> 2)What type of log files are important to ingest ?<BR /> 3)Any guidance related to dashboard things would be highly appreciated </P> <P>Thank you all.</P> Fri, 07 Sep 2018 09:17:05 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-do-I-pull-SharePoint-logs-into-Splunk/m-p/446079#M54874 raj_mpl 2018-09-07T09:17:05Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-do-I-pull-SharePoint-logs-into-Splunk/m-p/446080#M54875 <P>Anyone ???</P> Tue, 11 Sep 2018 06:48:46 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-do-I-pull-SharePoint-logs-into-Splunk/m-p/446080#M54875 raj_mpl 2018-09-11T06:48:46Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-do-I-pull-SharePoint-logs-into-Splunk/m-p/446081#M54876 <P>I agree, that Splunk Add-On only goes to 2012 and the world has moved on. It would be nice to be able to get SP 2016 logs into Splunk.</P> Wed, 03 Apr 2019 04:57:12 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-do-I-pull-SharePoint-logs-into-Splunk/m-p/446081#M54876 kmower 2019-04-03T04:57:12Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-do-I-pull-SharePoint-logs-into-Splunk/m-p/446082#M54877 <P>It would be really beneficial to a lot of people to provide support for the on prem version SharePoint 2016 as not everyone is willing/ready to use the cloud version.</P> Thu, 09 Jan 2020 14:10:25 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-do-I-pull-SharePoint-logs-into-Splunk/m-p/446082#M54877 bullbo 2020-01-09T14:10:25Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-do-I-pull-SharePoint-logs-into-Splunk/m-p/446083#M54878 <P>This is the info that I am pulling into Splunk from SharePoint 2019</P> <UL> <LI>perfmon</LI> <LI>IIS logs</LI> <LI>ULS logs</LI> </UL> <P>I am storing the IIS and ULS logs in a sharepoint index. I built out a correlation search dashboard so I don't have to use the Merge-SPLogFile cmdlet for PowerShell.</P> <P>Here are the inputs.conf, props.conf and transforms.conf</P> <H1>IIS</H1> <P>[monitor://L:\inetpub\logs\LogFiles**.log]<BR /> index = sharepoint<BR /> sourcetype = iis<BR /> ignoreOlderThan = 1d</P> <H1>ULS</H1> <P>[monitor://L:\Diagnosticslog]<BR /> index = sharepoint<BR /> whitelist = .*-\d+-\d+.log$<BR /> sourcetype = MSSharePoint:2019:ULSAudit<BR /> ignoreOlderThan = 1d</P> <H1>PROPS.CONF</H1> <P>[MSSharePoint:2019:ULSAudit]<BR /> SHOULD_LINEMERGE = false<BR /> CHECK_FOR_HEADER = false<BR /> LINE_BREAKER = ([\r\n]+)\d{2}/\d{2}/\d{4}\s\d{2}:\d{2}:\d{2}.\d{2}\s<BR /> TRANSFORMS-ulscomment = uls_remove_comments<BR /> SEDCMD-cleanup = s/(...([^*]+).*?...)//g</P> <H1>TRANSFORMS.CONF</H1> <P>[uls_remove_comments]<BR /> REGEX = ^Timestamp<BR /> DEST_KEY = queue<BR /> FORMAT = nullQueue</P> Wed, 30 Sep 2020 04:35:06 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-do-I-pull-SharePoint-logs-into-Splunk/m-p/446083#M54878 mswenson 2020-09-30T04:35:06Z