Getting Data In

How do you check where an index is being sent to on an IIS Box ?

itrimble1
Path Finder

We have this on /etc/system/local for testing

Inputs.conf file

[default]

host = server name goes here

[monitor://C:\inetpub\logs\LogFiles\W3SVC1]
sourcetype = ms:iis:default
index = ms_iis
Tags (2)
0 Karma

woodcock
Esteemed Legend

Try these:

$SPLUNK_HOME/bin/splunk btool inputs list --debug
$SPLUNK_HOME/bin/splunk btool props list --debug
0 Karma

anthonymelita
Contributor

You have that in the $SPLUNK_HOME/etcsystem/local, but if you chose to index IIS logs during the MSI install process then it will probably be in a different app under $SPLUNK_HOME/etc/apps

0 Karma

lakshman239
SplunkTrust
SplunkTrust

per the above, your sourcetype = ms:iis:default logs goes to index=ms_iis

you can search for index=ms_iss sourcetype=ms* to check all sourcetypes related to IIS logs.

0 Karma

itrimble1
Path Finder

I meant from the IIS Box. Which logs on the IIS box would tell me that it's going to the ms_iis index.

I am trying to troubleshoot, why they keep ending up in the catchall main index.

0 Karma

somesoni2
Revered Legend

Run btool on the machine to see what index is actually applied. Other than then, you can look at metrics.log to see which index that sourcetype is going to.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.