https://community.splunk.com/t5/Getting-Data-In/custom-iis-sourcetype-field-extractions/m-p/480763#M82428 <P>trying to copy standard IIS field extractions to a new custom sourcetype, however these are not displaying from the indexer cluster. any suggestions? am I missing a transforms in the custom app? looked for any reference of iis in the transforms.conf located in system/default, but could not find any reference. </P> <P>props.conf (custom app1)<BR /> [emea_qa_iis_logs]<BR /> CHARSET=UTF-8<BR /> INDEXED_EXTRACTIONS=w3c<BR /> MAX_TIMESTAMP_LOOKAHEAD=32<BR /> SHOULD_LINEMERGE=false<BR /> category=Web<BR /> description=W3C Extended log format produced by the Microsoft Internet Information Services (IIS) web server<BR /> detect_trailing_nulls=auto<BR /> disabled=false<BR /> pulldown_type=true<BR /> TZ=GMT<BR /> LINE_BREAKER=([\r\n]+)</P> <P>props.conf (system/default)<BR /> [iis]<BR /> CHARSET=UTF-8<BR /> INDEXED_EXTRACTIONS=w3c<BR /> MAX_TIMESTAMP_LOOKAHEAD=32<BR /> SHOULD_LINEMERGE=false<BR /> category=Web<BR /> description=W3C Extended log format produced by the Microsoft Internet Information Services (IIS) web server<BR /> detect_trailing_nulls=auto<BR /> disabled=false<BR /> pulldown_type=true<BR /> LINE_BREAKER=([\r\n]+)</P> Wed, 30 Sep 2020 02:11:07 GMT fisuser1 2020-09-30T02:11:07Z https://community.splunk.com/t5/Getting-Data-In/custom-iis-sourcetype-field-extractions/m-p/480763#M82428 <P>trying to copy standard IIS field extractions to a new custom sourcetype, however these are not displaying from the indexer cluster. any suggestions? am I missing a transforms in the custom app? looked for any reference of iis in the transforms.conf located in system/default, but could not find any reference. </P> <P>props.conf (custom app1)<BR /> [emea_qa_iis_logs]<BR /> CHARSET=UTF-8<BR /> INDEXED_EXTRACTIONS=w3c<BR /> MAX_TIMESTAMP_LOOKAHEAD=32<BR /> SHOULD_LINEMERGE=false<BR /> category=Web<BR /> description=W3C Extended log format produced by the Microsoft Internet Information Services (IIS) web server<BR /> detect_trailing_nulls=auto<BR /> disabled=false<BR /> pulldown_type=true<BR /> TZ=GMT<BR /> LINE_BREAKER=([\r\n]+)</P> <P>props.conf (system/default)<BR /> [iis]<BR /> CHARSET=UTF-8<BR /> INDEXED_EXTRACTIONS=w3c<BR /> MAX_TIMESTAMP_LOOKAHEAD=32<BR /> SHOULD_LINEMERGE=false<BR /> category=Web<BR /> description=W3C Extended log format produced by the Microsoft Internet Information Services (IIS) web server<BR /> detect_trailing_nulls=auto<BR /> disabled=false<BR /> pulldown_type=true<BR /> LINE_BREAKER=([\r\n]+)</P> Wed, 30 Sep 2020 02:11:07 GMT https://community.splunk.com/t5/Getting-Data-In/custom-iis-sourcetype-field-extractions/m-p/480763#M82428 fisuser1 2020-09-30T02:11:07Z https://community.splunk.com/t5/Getting-Data-In/custom-iis-sourcetype-field-extractions/m-p/480764#M82429 <P>Are the logs coming from a heavy or universal forwarder?</P> Fri, 13 Sep 2019 15:36:49 GMT https://community.splunk.com/t5/Getting-Data-In/custom-iis-sourcetype-field-extractions/m-p/480764#M82429 jacobpevans 2019-09-13T15:36:49Z https://community.splunk.com/t5/Getting-Data-In/custom-iis-sourcetype-field-extractions/m-p/480765#M82430 <P>UFs to a heavy forwarder, but I have applied the props on the HF too. </P> Fri, 13 Sep 2019 15:47:59 GMT https://community.splunk.com/t5/Getting-Data-In/custom-iis-sourcetype-field-extractions/m-p/480765#M82430 fisuser1 2019-09-13T15:47:59Z