Using the Splunk Add-on for Microsoft IIs, why am I getting sourcetype=iis in searches despite setting sourcetype=ms:iis:auto on the universal forwarder?

[damode]

As the title says, I have deployed the Splunk Add-on for Microsoft IIS on the Universal Forwarder and have installed the add-ons on the Indexer and Search Head according to the docs.

However, despite all that, I am getting sourcetype=iis in searches. It looks like Splunk is applying the sourcetype=iis from its props.conf in defaults directory.

Can someone please advise how I can fix this ?

[jgbricker]

Check a few things out such as permission to the add on main directory and the subfiles and folders allowing splunkd to at least have privilege to read them. Ensure Splunkd has been restarted since the deployment. You can also use btool to check for conflicts where the file is ingested such as something in a higher precedence like system/local or another local folder. Also, if you just made changes the sourcetyping would apply to net new events.

$SPLUNK_HOME/bin/splunk cmd btool list

[damode]

I have checked the following,

• permissions on the add-on and input file and verified its correct.
• did reload deploy-server

- used btool and got the following result on the Indexer,

 c:\>splunk btool props list --debug | findstr iis
C:\Program Files\Splunk\etc\system\default\props.conf                         [iis]
C:\Program Files\Splunk\etc\apps\Splunk_TA_microsoft-iis\default\props.conf   [ms:iis:auto]

[jgbricker]

Good start can do the same checks on the UF too?

[cboillot]

Yes, the btool command will work on the UFs