topic Re: IIS Logs and Universal Forwarder? in Getting Data In

IIS Logs and Universal Forwarder?

singhg — Thu, 19 Apr 2012 19:35:06 GMT

Hi,

I am trying to forward IIS logs from one of the server that has forwarder installed. I have below config settings. I don't see any IIS logs on my splunk server.

Inputs.conf
[monitor://c:\inetpub\logs\LogFiles]
ignoreOlderThan = 14d
host =

What Am I missing?

Re: IIS Logs and Universal Forwarder?

yannK — Fri, 28 Sep 2012 17:26:24 GMT

on the forwarder, define an input in a inputs.conf

[monitor://c:\myiisfolder\]
disabled = false
followTail = 0
sourcetype=iis

make sure that the forwarder has outputs.conf configured.

Re: IIS Logs and Universal Forwarder?

paul_1994 — Fri, 28 Sep 2012 22:11:15 GMT

Everything looks correct to me as far as my setup goes.

where are you editing the inputs.conf file? is it in etc\system\local or some app?

Re: IIS Logs and Universal Forwarder?

mahsaalaeifar — Tue, 29 Sep 2020 22:12:36 GMT

if you have deployment server and want to collect logs from web server through Universal Forwarder, the following may help you

install "Splunk app for web analytics" on SH
Install "splunk add-on for microsioft iis" on SH
Install "splunk add-on for microsioft iis" on IDX
Install UF on the web server
Copy the app “Splunk_TA_microsoft-iis” from $splunk home/etc/apps to “Splunk_TA_microsoft-iis” in $splunk home/etc/deploymentapps
Create inputs.conf in /$splunk home/etc/deploymentapps /Splunk_TA_microsoft-iis/local

monitor://C:\IIS-LOG-Files\W3SVC*.*
disabled = false
sourcetype =iis
index=my-index

Create props.conf in $splunk home/etc/deploymentapps/Splunk_TA_microsoft-iis/local

[iis]
INDEXED_EXTRACTIONS = w3c

make sure you have created output.conf in local directory to send logs to indexer
example of outputs.conf :

[tcpout]
defaultGroup = indexer

[tcpout:indexer]
server = indexer_IP:9997
autoLB = true

Create server class my-serverclass on DS(Deployment server)
Add the Splunk_TA_microsoft-iis to My-serverclass as the app
Create the index My index on IDX
Add the web server as client to My-server-class
Check the web server c:/programfile/splunkuniversalforwarder/ec/app to assure the app Splunk_TA_microsoft-iis is pulled
Restart the splunkuniversalforwarder service on web server
Search for sourcetype iis and index My-index on SH