Getting Data In

IIS Logs by Application

MCrank
Engager

Hello all. Splunk Newbie here so forgive me if some of this may be redundant. I did some searching through the answers and couldn't really find an answer to what I am attempting to do. Maybe I am going about it wrong and just need to leverage the search capabilities.

So we have our IIS logs setup in a directory similar to this:

D:\Logs\Web\App1
\App2
\App3

Is it possible to configure the UF to configure a source type for each individual App to better segregate the logs for each individual APP within Splunk. The idea is to be able to filter the logs based on Source Type App1 and then perform searches just within the IIS logs for App1? Or is this just silliness within the splunk world? Some of our Apps generate Many GBs of IIS log data per data so I thought it would be nice to separate the Logs out like this. There may be another way to do this as well. I am open to any suggestions!

Thank you

Tags (1)
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

Technically speaking, you can separate them out in that manner. You can do something like:

[monitor://D:\LogsWebApp1]
sourcetype = App1

[monitor://D:\LogsWebApp2]
sourcetype = App2

[monitor://D:\LogsWebApp3]
sourcetype = App3

Then you can use props/transforms to specify the fields on your indexer.

View solution in original post

MCrank
Engager

That looks like it is working as I wanted. Thank you jbsplunk

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

Technically speaking, you can separate them out in that manner. You can do something like:

[monitor://D:\LogsWebApp1]
sourcetype = App1

[monitor://D:\LogsWebApp2]
sourcetype = App2

[monitor://D:\LogsWebApp3]
sourcetype = App3

Then you can use props/transforms to specify the fields on your indexer.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...