As the title says, I have deployed the Splunk Add-on for Microsoft IIS on the Universal Forwarder and have installed the add-ons on the Indexer and Search Head according to the docs.
However, despite all that, I am getting sourcetype=iis in searches. It looks like Splunk is applying the sourcetype=iis from its props.conf in defaults directory.
Can someone please advise how I can fix this ?
Check a few things out such as permission to the add on main directory and the subfiles and folders allowing splunkd to at least have privilege to read them. Ensure Splunkd has been restarted since the deployment. You can also use btool to check for conflicts where the file is ingested such as something in a higher precedence like system/local or another local folder. Also, if you just made changes the sourcetyping would apply to net new events.
$SPLUNK_HOME/bin/splunk cmd btool list
I have checked the following,
c:\>splunk btool props list --debug | findstr iis C:\Program Files\Splunk\etc\system\default\props.conf [iis] C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-iis\default\props.conf [ms:iis:auto]