Getting Data In

IIS Logs - Format Question

JoshuaThompson
New Member

I have added some IIS logs to Splunk via the "Files and Directories" input. While I can query the raw data it does not appear that Splunk is recognizing the format of these logs. For example when I query "source="\\xxxxxxxxx\IIS Logs*"" I receive the following results:

119.63.193.195, -, 5/21/2014, 23:59:53, W3SVC3, xxxxxxxxx , xx.xx.xx.xx, 187, 144, 2800, 200, 64, GET, /, -,
date_hour = 23 date_mday = 21 date_minute = 59 date_month = may date_second = 53 date_wday = wednesday date_year = 2014 date_zone = local eventtype = wineventlog-index eventtype = winevents host = xxxxxxx index = main linecount = 1 punct = ...,-,//,::,,,...,,,,,,,/,-, source = \xxxxxxxxx\IIS Logs\u_in14052123.log sourcetype = u_in-too_small splunk_server = xxxxxxxxx timeendpos = 38 timestartpos = 19

The first part of the result "119.63.193.195" is the client IP that accessed this website. My issue is that splunk is not recognizing this field as the clientip.

My logs are in IIS format.

What am I doing wrong?

Additionally, in the above results, what is "punct = ...,-,//,::,,,...,,,,,,,/,-,"?

Thank you for your time.

Tags (3)
0 Karma

terridonahue
Engager

Splunk is probably looking for a specific format. Try changing your IIS server to use W3C log format rather than IIS since it is a standard logging format.

JoshuaThompson
New Member

Terridonahue - If you find the answer please let me know. I will do likewise. Thank you for the information on "punct". I do appreciate it.

0 Karma

terridonahue
Engager

I am looking to see if there is. I am sure it can be designated on the conf file but need to determine what goes there. Also punct is simply the entire line item with everything but punctuation removed. You can use it to find like items. For more info: http://docs.splunk.com/Splexicon:Punct

0 Karma

JoshuaThompson
New Member

Is there a way that I can tell Splunk the format of my data? Changing the format to W3C helps me going forward but it does not help for the data that has already been indexed.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...