All Apps and Add-ons

Splunk Add-on for Microsoft IIS: Tagging and Filtering

New Member


The Splunk_TA_microsoft_iis add-on deploys eventtypes.conf and tags.conf that should "tag" the events with "web", "Inventory" and "Activity" tags. inputs.conf sets my sourcetype=ms:iis:auto, eventtypes.conf defines a "microsoft_iis_web" eventtype for all events where sourcetypes=ms:iis:*, tags.conf then sets the tags for all events with eventtype=microsoft_iis_web.
This should work but doesn't. Any clues anyone ? When is the tagging done ? on the universal forwarder ? on the indexer ? on the SH ?

Trying to throw away the Response Code 200 events using props.conf and transforms.conf. props.conf defines a TRANSFORMS stanza for sourcetype [ms:iis:auto] to execute "drop200", drop200 is defined in transforms.conf and sets the source_key=field:sc_status before applying Regex=200 and routing to nullQueue. Yet all events are indexed, 200's and all, as if the transformation was not there. Any clues anyone ?

TIA, Johan

0 Karma

New Member

First part of the puzzle is solved. Tags are now assigned correctly. Installing the add-on on the indexer layer and the search head took care of this. My bad for only installing the add-on on the Universal Forwarder layer.

Filtering is still not working though, props and transforms look OK, sourcetype is correctly selected, transformation is correctly defined, seems like the regular expression is not matching the event data. REGEX=200 should match any event with 200 in its data or ?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...