All Apps and Add-ons

App for generating inputs.conf for IIS

Path Finder

The Splunk Add-on for Microsoft IIS still requires the administrator to manually create an inputs.conf file on each IIS host, customized with the paths of all Log directories. For large, diverse environments, this can be time consuming.

The following app can be deployed to your Windows servers, alongside the IIS add-on. On first-run it will automatically populate its inputs.conf with monitor stanzas. Each monitor will correspond to one IIS website's log folder.

├── bin
│   ├── generate_inputs.cmd
│   ├── generate_inputs.ps1
│   └── restart_splunk.cmd
├── default
│   └── app.conf
└── local
    ├── app.conf
    └── inputs.conf


REM store path of this bin folder
set "BINPATH=%~dp0"
REM set "SPLUNK_HOME=C:\Program Files\SplunkUniversalForwarder"

Powershell -ExecutionPolicy ByPass -File "%BINPATH%generate_inputs.ps1" -splunkHome "%SPLUNK_HOME%"


# generate inputs.conf for IIS

Import-Module WebAdministration
$INPUTSCONF = "$PSScriptRoot\..\local\inputs.conf"

# only if IIS websites exist and inputs.conf contains no monitors
If ((Get-Website) -And (-Not (Select-String -Pattern "^\[monitor" -Path "$INPUTSCONF" -quiet))) {
 foreach($WebSite in $(get-website)) {
  Add-Content -Path "$INPUTSCONF" -Value ""
  Add-Content -Path "$INPUTSCONF" -Value "# $($"
  Add-Content -Path "$INPUTSCONF" -Value "[monitor://$logfile]"
  Add-Content -Path "$INPUTSCONF" -Value "disabled = false"
  Add-Content -Path "$INPUTSCONF" -Value "ignoreOlderThan = 14d"
  Add-Content -Path "$INPUTSCONF" -Value "sourcetype = ms:iis:auto"
  Add-Content -Path "$INPUTSCONF" -Value "index = default"
 # restart splunk if inputs.conf now contains monitors
 if (Select-String -Pattern "^\[monitor" -Path "$INPUTSCONF" -quiet) {
  Invoke-WmiMethod -Class Win32_Process -Name Create -ArgumentList "$PSScriptRoot\restart_splunk.cmd"


@echo off
 timeout /t 5
 rem "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" restart
 sc stop SplunkForwarder
 sc start SplunkForwarder


disabled = False
index = _internal
interval = -1

# autogenerated monitors will be written below this line

Limitations: the script will not change inputs.conf once it has been written out. It would need to be undeployed/redeployed to catch up to any IIS configuration changes. It also will not resolve environment variables in the paths other than systemdrive (which would be unusual, but could happen). It's also possible for a Windows foldername to contain a bracket "]" character which might crash the [monitor://] stanza. I haven't tested, and don't know if there's a method for escaping it.

Ultra Champion

@satyenshah very cool post, but is there a question here?
if you created an app for the community to use, publish it on splunkbase:
for guidlines on how to publish an app, read here:
and submit here:

again, if it is not a question, kindly close it by accepting the answer

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...