Getting Data In

IIS Logs by Application

MCrank
Engager

Hello all. Splunk Newbie here so forgive me if some of this may be redundant. I did some searching through the answers and couldn't really find an answer to what I am attempting to do. Maybe I am going about it wrong and just need to leverage the search capabilities.

So we have our IIS logs setup in a directory similar to this:

D:\Logs\Web\App1
\App2
\App3

Is it possible to configure the UF to configure a source type for each individual App to better segregate the logs for each individual APP within Splunk. The idea is to be able to filter the logs based on Source Type App1 and then perform searches just within the IIS logs for App1? Or is this just silliness within the splunk world? Some of our Apps generate Many GBs of IIS log data per data so I thought it would be nice to separate the Logs out like this. There may be another way to do this as well. I am open to any suggestions!

Thank you

Tags (1)
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

Technically speaking, you can separate them out in that manner. You can do something like:

[monitor://D:\LogsWebApp1]
sourcetype = App1

[monitor://D:\LogsWebApp2]
sourcetype = App2

[monitor://D:\LogsWebApp3]
sourcetype = App3

Then you can use props/transforms to specify the fields on your indexer.

View solution in original post

MCrank
Engager

That looks like it is working as I wanted. Thank you jbsplunk

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

Technically speaking, you can separate them out in that manner. You can do something like:

[monitor://D:\LogsWebApp1]
sourcetype = App1

[monitor://D:\LogsWebApp2]
sourcetype = App2

[monitor://D:\LogsWebApp3]
sourcetype = App3

Then you can use props/transforms to specify the fields on your indexer.

Get Updates on the Splunk Community!

Developer Spotlight with Brett Adams

In our third Spotlight feature, we're excited to shine a light on Brett—a Splunk consultant, innovative ...

Index This | What can you do to make 55,555 equal 500?

April 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...