IIS Logs - Format Question

[JoshuaThompson]

I have added some IIS logs to Splunk via the "Files and Directories" input. While I can query the raw data it does not appear that Splunk is recognizing the format of these logs. For example when I query "source="\\xxxxxxxxx\IIS Logs*"" I receive the following results:

119.63.193.195, -, 5/21/2014, 23:59:53, W3SVC3, xxxxxxxxx , xx.xx.xx.xx, 187, 144, 2800, 200, 64, GET, /, -,
date_hour = 23 date_mday = 21 date_minute = 59 date_month = may date_second = 53 date_wday = wednesday date_year = 2014 date_zone = local eventtype = wineventlog-index eventtype = winevents host = xxxxxxx index = main linecount = 1 punct = ...,-,//,::,,,...,,,,,,,/,-, source = \xxxxxxxxx\IIS Logs\u_in14052123.log sourcetype = u_in-too_small splunk_server = xxxxxxxxx timeendpos = 38 timestartpos = 19

The first part of the result "119.63.193.195" is the client IP that accessed this website. My issue is that splunk is not recognizing this field as the clientip.

My logs are in IIS format.

What am I doing wrong?

Additionally, in the above results, what is "punct = ...,-,//,::,,,...,,,,,,,/,-,"?

Thank you for your time.

[terridonahue]

Splunk is probably looking for a specific format. Try changing your IIS server to use W3C log format rather than IIS since it is a standard logging format.

[JoshuaThompson]

Terridonahue - If you find the answer please let me know. I will do likewise. Thank you for the information on "punct". I do appreciate it.

[terridonahue]

I am looking to see if there is. I am sure it can be designated on the conf file but need to determine what goes there. Also punct is simply the entire line item with everything but punctuation removed. You can use it to find like items. For more info: http://docs.splunk.com/Splexicon:Punct

[JoshuaThompson]

Is there a way that I can tell Splunk the format of my data? Changing the format to W3C helps me going forward but it does not help for the data that has already been indexed.