if you have deployment server and want to collect logs from web server through Universal Forwarder, the following may help you
monitor://C:\IIS-LOG-Files\W3SVC*.*
disabled = false
sourcetype =iis
index=my-index
[iis]
INDEXED_EXTRACTIONS = w3c
make sure you have created output.conf in local directory to send logs to indexer
example of outputs.conf :
[tcpout]
defaultGroup = indexer
[tcpout:indexer]
server = indexer_IP:9997
autoLB = true
Everything looks correct to me as far as my setup goes.
where are you editing the inputs.conf file? is it in etc\system\local or some app?
on the forwarder, define an input in a inputs.conf
[monitor://c:\myiisfolder\] disabled = false followTail = 0 sourcetype=iis
make sure that the forwarder has outputs.conf configured.