Getting Data In

IIS Advance Logs Forwarding

jgodfrey_kumc
Engager

Mt question here is very similar to the question posted here: http://serverfault.com/questions/469383/iis-advanced-logging-forward-to-syslog.

I am looking for a method that would allow us to forward the IIS Advanced Logging logs to Splunk. We are able to forward regular IIS logs; however I am not sure how to make it work the same for IIS Advanced Logging.

The default file path is different for IIS Advanced Logging (%SystemDrive%\inetpub\logs\AdvancedLogs) and it appears that the file names are based upon the UTC time, see here, and not the local date and time that you can specify with regular logging. This also creates and issue for developing some type of wildcard rule.

Any ideas are welcome.

0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

I implemented this with a new sourcetype and input. I justified a new sourcetype because it is a different model than iis, and has different fields available.

inputs.conf on the IIS Server

[monitor://%SYSTEM_DRIVE%/inetpublogs/AdvancedLogs/*]
sourcetype=iis_advanced

props.conf on the INDERXER
[iis_advanced]
TZ = GMT

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

I implemented this with a new sourcetype and input. I justified a new sourcetype because it is a different model than iis, and has different fields available.

inputs.conf on the IIS Server

[monitor://%SYSTEM_DRIVE%/inetpublogs/AdvancedLogs/*]
sourcetype=iis_advanced

props.conf on the INDERXER
[iis_advanced]
TZ = GMT

jgodfrey_kumc
Engager

No, I have not gotten it to work with a User Agent string. I would be interested in how to make that work if anyone else has any details.

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

nope, I just index everything in the folder and it displays just fine. Related to Advanced IIS, have you ever gotten the filter to work with a User Agent String?

0 Karma

jgodfrey_kumc
Engager

Do you have any problems with it obtaining the current information since the log files are constantly changing names and to which file is being written to?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...