topic Re: Enable Logging for IIS Fields in Getting Data In

Enable Logging for IIS Fields

matthew-miller — Mon, 24 Jul 2023 21:03:41 GMT

Currently we have Microsoft IIS Web-Servers out in the environment, but the fields they are logging is spotty. Is there any way to enable logging for all available fields?

We have a deployment server, would that be of help in this situation?

For context, I've included a list of some specific fields we're looking for below:

date, time, c-ip, cs-username, s-ip, s-port, cs-method, cs-uri-stem, etc.

Re: Enable Logging for IIS Fields

PickleRick — Mon, 24 Jul 2023 21:36:36 GMT

https://docs.splunk.com/Documentation/AddOns/released/MSIIS/Hardwareandsoftwarerequirements#Microsoft_IIS_setup_requirements

Re: Enable Logging for IIS Fields

matthew-miller — Tue, 25 Jul 2023 14:03:52 GMT

Will the add-on allow me to change what data is coming in? I was under the impression that just parsed log files.

Re: Enable Logging for IIS Fields

PickleRick — Wed, 26 Jul 2023 06:00:50 GMT

Did you see that particular page I pointed you to? There is a section on where and for what exactly you should look in Microsoft's documentation to configure IIS properly.