topic Re: Search information from IIS logs in Getting Data In

Search information from IIS logs

tbalouch — Wed, 19 Feb 2014 20:16:08 GMT

Hi Guys,

Do you know of a Splunk App that facilitates searching of IIS logs? Also is there a way I can parse logs to find out which users attempted to login to my IIS servers and if they were successful or not? Is there a custom search I can use?

Re: Search information from IIS logs

dart — Wed, 19 Feb 2014 20:25:15 GMT

Hi,

When you're asking about login to IIS, do you mean logging onto Windows, or logging into a web page/app?

If it's the former, then the Splunk App for Windows includes setup for looking at windows logins, if it's the latter, and you're recording authentication in the IIS logs, then the Splunk Add-on for Weblogs can help you set up field extractions for pulling out the user field, which should get you most of the way to a report on logged in users.

Re: Search information from IIS logs

lukejadamec — Wed, 19 Feb 2014 20:40:50 GMT

IIS logs are great fun to search, if the search time extractions are configured correctly in splunk. Unfortunately, the configuration often requires manual adjustments. Read this post, it contains pretty much everything you need to know.

http://answers.splunk.com/answers/24986/iis-log-fields-not-parsing

Re: Search information from IIS logs

tbalouch — Thu, 20 Feb 2014 15:34:13 GMT

Thanks this is great!

Re: Search information from IIS logs

tbalouch — Thu, 20 Feb 2014 15:34:23 GMT

Thanks so much!