I can't seem to get Splunk to injest IIS 8.0 logfiles. I've installed a universal forwarder on a Windows Server 2012 server with IIS 8.0. IIS is configured to log in the w3c format. The UF is configured to monitor the IIS logfile folder.
In Splunk, I can see only a few events, parsing the first two lines of the log file, which are comments and should be ignored. The actually IIS events are not present.
The source types on the events I am seeing in Splunk are "u_ex" and "iis-2".