IIS logs ingestion- Why is it showing 'invalid directory'?

[sonishar]

Hello All,

It is with reference to the Logs ingestion of IIS server. I  have universal forwarder installed on the IIS server and is getting windows log.

I want to ingest IIS logs. have downloaded  https://splunkbase.splunk.com/app/3185  and installed on search head

was referencing https://docs.splunk.com/Documentation/AddOns/released/MSIIS/Setupaddon

but it is showing invalid directory and i am stuck.

My questions is where all i have to install Add on only Search head because that was mentioned in Splunk document

[gcusello]

Hi @sonishar,

as I already answered and also @isoutamo and @chaker said:

as you can read at https://docs.splunk.com/Documentation/AddOns/released/MSIIS/Install, you have to install this TA on the Search Heads for the search time parsing activities, but also on Indexers (for the indexes) and Heavy Forwarders (if present) and especially on the universal Forwarders where the logs are written.

Probably this is the reason of the invalid directory, because the TA doesn't find the IIS folder.

Ciao.

Giuseppe

[chaker]

This describes where you should install the addon. You should deploy a copy to the UF, with the correct input enabled, as per the link you originally posted.

https://docs.splunk.com/Documentation/AddOns/released/MSIIS/Install

Also take a look at  this post, which is a similar question to yours.

https://community.splunk.com/t5/Getting-Data-In/IIS-Logs/m-p/517651/highlight/true#M87578

[isoutamo]

Hi

One hint what I have used with these TAs.

I install original TA as is to all places where it is needed (e.g. UF, SH). Then I have second TA which contains only those enabled inputs for that "master" TA. In that way I can use exact same TA package on all nodes UF, HF, IDX and SH. No need to remove local inputs when deploy this to another node types than UF. Also when a new release has launch it's enough to just install it to correct places and if I need a rollback just remove and install older versio.

r. Ismo