Splunk and IIS Sourcetypes

jpewthers — Wed, 23 Jan 2013 22:15:35 GMT

I keep all the IIS web sites in the following folder: D:\inetpub\LogFiles

So the tree would look like this:

D:\inetpub\LogFiles
|-> W3SVC1
|-> W3SVC2...etc.

My input.conf is set as follows:
[monitor://D:\inetpub\LogFiles]
sourcetype=iis
ignoreOlderThan = 14d

HOWEVER...It appears that the logs are coming in and splunk is applying the following sourcetypes, seemingly at random to these IIS Log files:
iis
iis-2
iis-3
iis-4

Why? The logs are exactly the same. What are all of these others sourcetypes (iis-)?

Re: Splunk and IIS Sourcetypes

Ayn — Wed, 23 Jan 2013 22:48:50 GMT

This answer explains what goes on in detail: http://splunk-base.splunk.com/answers/72860/sourcetypes-keep-on-multiplying

topic Splunk and IIS Sourcetypes in Getting Data In

Splunk and IIS Sourcetypes

Re: Splunk and IIS Sourcetypes