topic Re: iis server on board into splunk in Getting Data In

iis server on board into splunk

ramkilku — Thu, 08 Mar 2018 00:52:17 GMT

Hello Professionals, we set up Splunk about 6 months ago, now we would like to onboard iis server to Splunk.May I know what exact procedure we have to follow in order to achieve this task

Thank you all

Re: iis server on board into splunk

anjambha — Thu, 08 Mar 2018 06:06:23 GMT

Hi ramkilku,

You can use ''Splunk Add-on for Microsoft IIS". Refer below link

link text

Re: iis server on board into splunk

esix_splunk — Thu, 08 Mar 2018 06:55:57 GMT

This is pretty straightforward. You need to deploy a UF onto your IIS Server and then deploy the Splunk Add-On for Microsoft IIS to the server. From that point, enable the inputs to read the IIS log files and mark the sourcetype properly.

This is outlined in the docs here : http://docs.splunk.com/Documentation/AddOns/released/MSIIS/Setupaddon

I would recommend using a Deployment Server to Manage your forwarders and push this app out to your IIS server(s).

Additionally, read through the notes and be aware that if you have modified any of the default fields, or added fields on the IIS side, you will need to modify the transforms for the extractions and update the fields.

Re: iis server on board into splunk

ramkilku — Thu, 08 Mar 2018 23:59:33 GMT

Thank you sir, i appreciate for your quick response