Archive

IIS Status Field

Path Finder

Hi,

I am having trouble getting Splunk to read the status field from my logs. I have put the following in my props.conf and restarted Splunk:

[iis]
TZ = GMT
CHECKFORHEADER = true
FIELDALIAS-status = "sc-status" AS status

If I search for eventtype=web-traffic, I see results. But, when I search eventtype=web-traffic status=200, I get 0 results.

My indexer in on Linux, forwarder on Windows. Can anyone help me?

Tags (1)
0 Karma
1 Solution

Path Finder

Well, I figured it out on my own. In case anyone else has the same problem, this is what I did. First, I put this in my props.conf:

[iis]
TZ = GMT
CHECKFORHEADER = true
REPORT-AutoHeader = AutoHeader-1
FIELDALIAS-status = cip AS clientip csReferer_ AS refererdomain csUserAgent AS useragent cshost AS host csmethod AS method csuriquery AS q csuristem AS uri sc_status AS status

and this in transforms.conf:
[AutoHeader-1]
DELIMS = " "
FIELDS = "date", "time", "s-ip", "cs-method", "cs-uri-stem", "cs-uri-query", "s-port", "cs-username", "c-ip", "cs(User-Agent)", "sc-status", "sc-substatus", "sc-win32-status", "time-taken"

I'm not sure why the field aliases use a "_" instead of "-", but it works!

View solution in original post

0 Karma

Path Finder

Well, I figured it out on my own. In case anyone else has the same problem, this is what I did. First, I put this in my props.conf:

[iis]
TZ = GMT
CHECKFORHEADER = true
REPORT-AutoHeader = AutoHeader-1
FIELDALIAS-status = cip AS clientip csReferer_ AS refererdomain csUserAgent AS useragent cshost AS host csmethod AS method csuriquery AS q csuristem AS uri sc_status AS status

and this in transforms.conf:
[AutoHeader-1]
DELIMS = " "
FIELDS = "date", "time", "s-ip", "cs-method", "cs-uri-stem", "cs-uri-query", "s-port", "cs-username", "c-ip", "cs(User-Agent)", "sc-status", "sc-substatus", "sc-win32-status", "time-taken"

I'm not sure why the field aliases use a "_" instead of "-", but it works!

View solution in original post

0 Karma