Unable to ingest advanced IIS Logs into the Splunk App.

[stonomet]

Hello,

Can anyone kindly assist me with this item? I have multiple webservers and not all of them are forwarding the IIS logs into splunk.

I have configured my input.conf  to:

[monitor://G:\wwwlogs]
disabled = 0
sourcetype = ms:iis:auto
index=iislogs
initCrcLength=2048
alwaysOpenFile = 1

I have attempted many different settings and scenarios. Any help is much appreciated.

Thanks in advance

[richgalloway]

Is there anything in the forwarder's logs that might indicate why the IIS logs are not being forwarded?  Are you seeing other event types from those forwarders (like internal logs)?

[stonomet]

I see the Windows Event Logs. But not IIS. Seems strange. Is there any other configurations that I have not done to get Splunk to pull the IIS logs?

[richgalloway]

That answers my second question, but what about the first?  Are there any error's the forwarder's splunkd.log that might explain why it's not sending IIS logs?