IIS Logs not Parsing as expected

djreschke — Mon, 25 Oct 2021 17:07:17 GMT

I have a props conf file that is not parsing data as i expected. I can see in the raw log that the IIS log has the header information in it.

[sourcetype]

DATETIME_CONFIG =
INDEXED_EXTRACTIONS = w3c
LINE_BREAKER = ([\r\n]+)
MAX_TIMESTAMP_LOOKAHEAD = 32
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Web
description = W3C Extended log format produced by the Microsoft Internet Information Services (IIS) web server
detect_trailing_nulls = auto
disabled = false
pulldown_type = true

When i manual upload the log file and assigning it to it will parse out the log with the same settings.

[sourcetypeA]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = w3c
LINE_BREAKER = ([\r\n]+)
MAX_TIMESTAMP_LOOKAHEAD = 32
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Web
description = W3C Extended log format produced by the Microsoft Internet Information Services (IIS) web server
detect_trailing_nulls = auto
disabled = false
pulldown_type = true

This props is on the searchhead were i am searching the data. The IIS logs is being capture via a UF.

Has anyone run into this before?

Re: IIS Logs not Parsing as expected

djreschke — Mon, 25 Oct 2021 18:11:08 GMT

Needed to create a transforms to fix the issue.

topic Re: IIS Logs not Parsing as expected in Splunk Search

IIS Logs not Parsing as expected

Re: IIS Logs not Parsing as expected