Add on for IIS: sourcetypes

[cmeo-bcit]

I am wondering why the search-time configurations for this app have been deprecated.

You can't do additional parsing steps if needed once you use INDEXED_EXTRACTIONS, and also you will consume a lot of extra storage for many fields that simply do not need to be indexed. I would have thought that search-time extraction would be preferable. At the very least it should continue to be available, depending on the use case.

Can anyone explain the reasoning behind this decision?

[livehybrid]

Hi @cmeo-bcit 

Sometimes INDEXED_EXTRACTIONS are used because the data is used in searches like tstats which generally utilises indexed fields. If the data is typically used for security usecases where tstats are heavily used then this might be a reason for them indexing the fields.

Since this is a Splunk supported app you can approach Support and ask for more information about this and hopefully they can help you further.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[tej57]

Hey @cmeo-bcit,

If the add-on you're currently facing challenges with is https://splunkbase.splunk.com/app/3185, feel free to raise a Support Case to get the answer. The TA development team might have some reason for enabling INDEXED_EXTRACTIONS.

Thanks,
Tejas.