Getting Data In

How do you check where an index is being sent to on an IIS Box ?

Path Finder

We have this on /etc/system/local for testing

Inputs.conf file

[default]

host = server name goes here

[monitor://C:\inetpub\logs\LogFiles\W3SVC1]
sourcetype = ms:iis:default
index = ms_iis
Tags (2)
0 Karma

Esteemed Legend

Try these:

$SPLUNK_HOME/bin/splunk btool inputs list --debug
$SPLUNK_HOME/bin/splunk btool props list --debug
0 Karma

Communicator

You have that in the $SPLUNK_HOME/etcsystem/local, but if you chose to index IIS logs during the MSI install process then it will probably be in a different app under $SPLUNK_HOME/etc/apps

0 Karma

SplunkTrust
SplunkTrust

per the above, your sourcetype = ms:iis:default logs goes to index=ms_iis

you can search for index=ms_iss sourcetype=ms* to check all sourcetypes related to IIS logs.

0 Karma

Path Finder

I meant from the IIS Box. Which logs on the IIS box would tell me that it's going to the ms_iis index.

I am trying to troubleshoot, why they keep ending up in the catchall main index.

0 Karma

SplunkTrust
SplunkTrust

Run btool on the machine to see what index is actually applied. Other than then, you can look at metrics.log to see which index that sourcetype is going to.

0 Karma