We have this on /etc/system/local for testing
host = server name goes here
sourcetype = ms:iis:default
index = ms_iis
$SPLUNK_HOME/bin/splunk btool inputs list --debug
$SPLUNK_HOME/bin/splunk btool props list --debug
You have that in the $SPLUNK_HOME/etcsystem/local, but if you chose to index IIS logs during the MSI install process then it will probably be in a different app under $SPLUNK_HOME/etc/apps
per the above, your sourcetype = ms:iis:default logs goes to index=ms_iis
you can search for index=ms_iss sourcetype=ms* to check all sourcetypes related to IIS logs.
I meant from the IIS Box. Which logs on the IIS box would tell me that it's going to the ms_iis index.
I am trying to troubleshoot, why they keep ending up in the catchall main index.
Run btool on the machine to see what index is actually applied. Other than then, you can look at metrics.log to see which index that sourcetype is going to.