topic Add on for IIS: sourcetypes in Getting Data In

Add on for IIS: sourcetypes

cmeo-bcit — Fri, 15 Aug 2025 01:43:10 GMT

I am wondering why the search-time configurations for this app have been deprecated.

You can't do additional parsing steps if needed once you use INDEXED_EXTRACTIONS, and also you will consume a lot of extra storage for many fields that simply do not need to be indexed. I would have thought that search-time extraction would be preferable. At the very least it should continue to be available, depending on the use case.

Can anyone explain the reasoning behind this decision?

Re: Add on for IIS: sourcetypes

tej57 — Fri, 15 Aug 2025 08:22:07 GMT

Hey @cmeo-bcit,

If the add-on you're currently facing challenges with is https://splunkbase.splunk.com/app/3185, feel free to raise a Support Case to get the answer. The TA development team might have some reason for enabling INDEXED_EXTRACTIONS.

Thanks,
Tejas.

Re: Add on for IIS: sourcetypes

livehybrid — Fri, 15 Aug 2025 14:49:10 GMT

Hi @cmeo-bcit

Sometimes INDEXED_EXTRACTIONS are used because the data is used in searches like tstats which generally utilises indexed fields. If the data is typically used for security usecases where tstats are heavily used then this might be a reason for them indexing the fields.

Since this is a Splunk supported app you can approach Support and ask for more information about this and hopefully they can help you further.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing