Getting Data In

IIS Logs by Application

MCrank
Engager

Hello all. Splunk Newbie here so forgive me if some of this may be redundant. I did some searching through the answers and couldn't really find an answer to what I am attempting to do. Maybe I am going about it wrong and just need to leverage the search capabilities.

So we have our IIS logs setup in a directory similar to this:

D:\Logs\Web\App1
\App2
\App3

Is it possible to configure the UF to configure a source type for each individual App to better segregate the logs for each individual APP within Splunk. The idea is to be able to filter the logs based on Source Type App1 and then perform searches just within the IIS logs for App1? Or is this just silliness within the splunk world? Some of our Apps generate Many GBs of IIS log data per data so I thought it would be nice to separate the Logs out like this. There may be another way to do this as well. I am open to any suggestions!

Thank you

Tags (1)
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

Technically speaking, you can separate them out in that manner. You can do something like:

[monitor://D:\LogsWebApp1]
sourcetype = App1

[monitor://D:\LogsWebApp2]
sourcetype = App2

[monitor://D:\LogsWebApp3]
sourcetype = App3

Then you can use props/transforms to specify the fields on your indexer.

View solution in original post

MCrank
Engager

That looks like it is working as I wanted. Thank you jbsplunk

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

Technically speaking, you can separate them out in that manner. You can do something like:

[monitor://D:\LogsWebApp1]
sourcetype = App1

[monitor://D:\LogsWebApp2]
sourcetype = App2

[monitor://D:\LogsWebApp3]
sourcetype = App3

Then you can use props/transforms to specify the fields on your indexer.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...