All Apps and Add-ons

How to configure the Splunk App for Web Analytics based on my sample log to get data in the app?


I followed the steps described in

The logs are in the format below:

2016-03-02 18:17:26 POST /blablablapage.asmx - 80 SERVERNAME Mozilla/4.0+(compatible;+MSIE+6.0;+MS+Web+Services+Client+Protocol+4.0.30319.34209) - - 200 1721 1566
host = HOSTNAME source = d:\iislogs\W3SVC3\logfilename.log sourcetype = CSIIS

For Step 2 - how would I exactly configure this? What would I put into the fields based on the logs above?
*The Splunk App for Web Analytics works in a multi website environment. Websites are configured from a combination of the host and the source field. Each event with that unique combination will be tagged with the corresponding website name in the field "site". You can use wildcards () in the Source and Host field to select multiple files matching a pattern. There is a website setup form page that allows you to add these in an easy way.
Here are some examples of valid website configurations with or without wildcards

No wildcards
Site Host Source server1 /var/log/httpd/access_log server2 /var/log/httpd/access_log

With wildcards
Site Host Source server /var/log/httpd/access_*

0 Karma

Splunk Employee
Splunk Employee

Hi Svenolensky

The correct configuration in the sites lookup would be
Site Host Source HOSTNAME d:\iislogs\W3SVC3\logfilename.log

However, as you have the sourcetype set to CSIIS the app will not work out of the box. Look in the documentation under the very first paragraph:

1. Import web server log data

The Splunk App for Web Analytics currently supports data from Apache and IIS logs. Make sure you use the sourcetype access_common, access_combined or **iis* for this data. If you already have data in Splunk under a different sourcetype you can use sourcetype renaming or by modifying the eventtype web-traffic to include the names of your sourcetypes.*

In the actual documentation page there is links directly to the settings that needs to be modified to use a different sourcetype. I recommend the sourcetype renaming approach.

Let me know how you get along.


0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...