I have added some IIS logs to Splunk via the "Files and Directories" input. While I can query the raw data it does not appear that Splunk is recognizing the format of these logs. For example when I query "source="\\xxxxxxxxx\IIS Logs*"" I receive the following results:
126.96.36.199, -, 5/21/2014, 23:59:53, W3SVC3, xxxxxxxxx , xx.xx.xx.xx, 187, 144, 2800, 200, 64, GET, /, -,
date_hour = 23 date_mday = 21 date_minute = 59 date_month = may date_second = 53 date_wday = wednesday date_year = 2014 date_zone = local eventtype = wineventlog-index eventtype = winevents host = xxxxxxx index = main linecount = 1 punct = ...,-,//,::,,,...,,,,,,,/,-, source = \xxxxxxxxx\IIS Logs\u_in14052123.log sourcetype = u_in-too_small splunk_server = xxxxxxxxx timeendpos = 38 timestartpos = 19
The first part of the result "188.8.131.52" is the client IP that accessed this website. My issue is that splunk is not recognizing this field as the clientip.
My logs are in IIS format.
What am I doing wrong?
Additionally, in the above results, what is "punct = ...,-,//,::,,,...,,,,,,,/,-,"?
Thank you for your time.
I am looking to see if there is. I am sure it can be designated on the conf file but need to determine what goes there. Also punct is simply the entire line item with everything but punctuation removed. You can use it to find like items. For more info: http://docs.splunk.com/Splexicon:Punct