https://community.splunk.com/t5/Splunk-Search/How-to-search-events-generated-by-TA/m-p/467918#M191896 <P>@Arpmjdr </P> <P>Are you using "Splunk Add-on for Microsoft IIS" (<A href="http://splunkbase.splunk.com/app/3185">http://splunkbase.splunk.com/app/3185</A>)? If yes then check events by executing below search?</P> <P>1) <CODE>sourcetype="ms:iis:auto"</CODE><BR /> 2) <CODE>sourcetype="ms:iis:default"</CODE></P> Wed, 04 Sep 2019 11:06:43 GMT kamlesh_vaghela 2019-09-04T11:06:43Z https://community.splunk.com/t5/Splunk-Search/How-to-search-events-generated-by-TA/m-p/467917#M191895 <P>Hello,</P> <P>I am using Splunk enterprise and splunk enterprise security. I have windows IIS TA configured as well.How to find the IIS events in splunk search in order to create alert.Kindly help</P> Wed, 04 Sep 2019 10:33:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-events-generated-by-TA/m-p/467917#M191895 Arpmjdr 2019-09-04T10:33:15Z https://community.splunk.com/t5/Splunk-Search/How-to-search-events-generated-by-TA/m-p/467918#M191896 <P>@Arpmjdr </P> <P>Are you using "Splunk Add-on for Microsoft IIS" (<A href="http://splunkbase.splunk.com/app/3185">http://splunkbase.splunk.com/app/3185</A>)? If yes then check events by executing below search?</P> <P>1) <CODE>sourcetype="ms:iis:auto"</CODE><BR /> 2) <CODE>sourcetype="ms:iis:default"</CODE></P> Wed, 04 Sep 2019 11:06:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-events-generated-by-TA/m-p/467918#M191896 kamlesh_vaghela 2019-09-04T11:06:43Z