topic Re: Don't forward old IIS Logs to Splunk in Getting Data In

Don't forward old IIS Logs to Splunk

daymar_23 — Fri, 05 Feb 2021 14:53:04 GMT

Hello All!

I am configuring Splunk in different servers to send the IIS Logs. I am doing it by adding the IIS Log Folder as a Data Input -> Files & Directories.

But in the IIS Log File there is old Logs, and I only want that send to splunk Logs from no more that two days.

I already configured in the .props.config the MAX_DAYS_AGO=2, but it doesn't work.

I have tried in these ways:

With the file in ...\etc\system\local\props.config

[iis]
MAX_DAYS_AGO=2

---------------- Didn't work

[default]
MAX_DAYS_AGO=2

------------------Didn't work

Changing the Default in the ..\etc\system\default\props.config

[default]
MAX_DAYS_AGO=2

------------------Didn't work

Restarting the Splunk service every time when I made the change

Could somebody say me what I am missing?

Thanks

Re: Don't forward old IIS Logs to Splunk

saravanan90 — Fri, 05 Feb 2021 15:12:08 GMT

This may help..

1. If the file is older than 2 days we can use ignoreOlderThan = 2d in inputs.conf in forwarder.

2. Please check the below configuration is in props.conf in HF/Indexer.

[iis]

MAX_DAYS_AGO=2

Re: Don't forward old IIS Logs to Splunk

daymar_23 — Fri, 05 Feb 2021 15:35:00 GMT

Thanks @saravanan90

Sorry, but I am new using splunk. So what do you mean by HF/Indexer?

My local props.config looks like:

[iis]
MAX_DAYS_AGO=2
TRANSFORMS-null = setnull,setNotFound

And under what label do I have to put the ignoreOlderThan = 2d in my local inputs.conf?

Thanks for your reply.

Re: Don't forward old IIS Logs to Splunk

saravanan90 — Fri, 05 Feb 2021 15:48:46 GMT

In inputs.conf we configure the file which needs to be monitored as below. We can add the "ignoreOlderThan = 2d" as below in inputs.conf so that it will exclude the files which are older than 2 days.

[monitor://path_to_logfile.log]
disabled = false
index = iis
sourcetype = iis
crcSalt = <SOURCE>
ignoreOlderThan = 2d

If we need to go through each individual events and ignore the data then we can add them where it is being parsed. If we are using intermediate Heavy forwarder for parsing, then configure here. If the logs being collected are sent directly to indexers then we can configure the below in indexers.

props.conf

[iis]
MAX_DAYS_AGO=2