Hello All,
We currently are ingesting IIS logs that are being created in W3C format. We're using a simple folder monitor with the following Inputs.conf syntax:
[monitor://C:\inetpub\logs\LogFiles]
disabled = false
recursive = true
index = iis_staging
sourcetype = iis
ignoreOlderThan = 7d
Now, our web admins want to change IIS logging from W3C to IIS format. I have installed the Splunk Add-on for Microsoft IIS app on our local deployment server, but I am concerned about existing logs in our cloud instance and what may happen to them if I switch the apps from just file monitor to the IIS app. Can the IIS app write to the same index or will I need to create a new index and take other steps to prepare for the new logging format?
Thanks in advance for any advice.
Best,
Chris
