https://community.splunk.com/t5/Splunk-Search/Not-creating-iis-fields-time-taken-with-splunk-6-1-and-iis-7-w3c/m-p/179178#M186818 <P>Nevermind, it looks like i can search on the fields no problem, it was just not showing up in the events window.</P> Tue, 12 Aug 2014 16:17:36 GMT rdstafford 2014-08-12T16:17:36Z https://community.splunk.com/t5/Splunk-Search/Not-creating-iis-fields-time-taken-with-splunk-6-1-and-iis-7-w3c/m-p/179177#M186817 <P>Looking at documents it appears that IIS w3c logs should auto create all the fields in the header. Am I wrong about that?</P> <P>If not how do i make it so all the fields are available to be easily searched. The end goal i have is graphing and alerting when certain calls take longer than 3 seconds. </P> Tue, 12 Aug 2014 15:54:17 GMT https://community.splunk.com/t5/Splunk-Search/Not-creating-iis-fields-time-taken-with-splunk-6-1-and-iis-7-w3c/m-p/179177#M186817 rdstafford 2014-08-12T15:54:17Z https://community.splunk.com/t5/Splunk-Search/Not-creating-iis-fields-time-taken-with-splunk-6-1-and-iis-7-w3c/m-p/179178#M186818 <P>Nevermind, it looks like i can search on the fields no problem, it was just not showing up in the events window.</P> Tue, 12 Aug 2014 16:17:36 GMT https://community.splunk.com/t5/Splunk-Search/Not-creating-iis-fields-time-taken-with-splunk-6-1-and-iis-7-w3c/m-p/179178#M186818 rdstafford 2014-08-12T16:17:36Z