https://community.splunk.com/t5/Getting-Data-In/IIS-logs-not-recognized/m-p/87384#M18121 <P>The stanza are case sensitive, the "w" of web is different in D:\logs\Web\ISALOG_20101005_WEB_000.w3c and [monitor://D:\logs\web\*.w3c]</P> <P>to fix, change the stanza to [monitor://D:\logs\Web\*.w3c]</P> Tue, 30 Nov 2010 05:26:35 GMT yannK 2010-11-30T05:26:35Z https://community.splunk.com/t5/Getting-Data-In/IIS-logs-not-recognized/m-p/87383#M18120 <P>After uninstalling Splunk 4.0.10 and doing a clean install of 4.1.4 proxy logs not recognized:</P> <PRE><CODE>11-10-2010 08:37:26.603 INFO TailingProcessor - No configurations match, will ignore path='D:\logs\Web\ISALOG_20101005_WEB_000.w3c'. </CODE></PRE> <P>Inputs.conf:</P> <PRE><CODE>[monitor://D:\logs\web\*.w3c] disabled = false followtail = 1 sourcetype = isa_web whitelist = \\logs\\* [monitor://D:\logs\firewall\*.w3c] disabled = true followtail = 1 sourcetype = isa_firewall </CODE></PRE> <P>Whitelist added per <A href="http://www.splunk.com/support/forum:SplunkAdministration/4423" rel="nofollow">http://www.splunk.com/support/forum:SplunkAdministration/4423</A>, but did not help. Actual case of path is D:\LOGS\Web, but changing monitor to match did not help.</P> Thu, 11 Nov 2010 02:16:31 GMT https://community.splunk.com/t5/Getting-Data-In/IIS-logs-not-recognized/m-p/87383#M18120 rgcox1 2010-11-11T02:16:31Z https://community.splunk.com/t5/Getting-Data-In/IIS-logs-not-recognized/m-p/87384#M18121 <P>The stanza are case sensitive, the "w" of web is different in D:\logs\Web\ISALOG_20101005_WEB_000.w3c and [monitor://D:\logs\web\*.w3c]</P> <P>to fix, change the stanza to [monitor://D:\logs\Web\*.w3c]</P> Tue, 30 Nov 2010 05:26:35 GMT https://community.splunk.com/t5/Getting-Data-In/IIS-logs-not-recognized/m-p/87384#M18121 yannK 2010-11-30T05:26:35Z