IIS Logs by Application

[MCrank]

Hello all. Splunk Newbie here so forgive me if some of this may be redundant. I did some searching through the answers and couldn't really find an answer to what I am attempting to do. Maybe I am going about it wrong and just need to leverage the search capabilities.

So we have our IIS logs setup in a directory similar to this:

D:\Logs\Web\App1
\App2
\App3

Is it possible to configure the UF to configure a source type for each individual App to better segregate the logs for each individual APP within Splunk. The idea is to be able to filter the logs based on Source Type App1 and then perform searches just within the IIS logs for App1? Or is this just silliness within the splunk world? Some of our Apps generate Many GBs of IIS log data per data so I thought it would be nice to separate the Logs out like this. There may be another way to do this as well. I am open to any suggestions!

Thank you

[MCrank]

That looks like it is working as I wanted. Thank you jbsplunk

[jbsplunk · Accepted solution]

Technically speaking, you can separate them out in that manner. You can do something like:

[monitor://D:\LogsWebApp1]
sourcetype = App1

[monitor://D:\LogsWebApp2]
sourcetype = App2

[monitor://D:\LogsWebApp3]
sourcetype = App3

Then you can use props/transforms to specify the fields on your indexer.