Hello All,
It is with reference to the Logs ingestion of IIS server. I have universal forwarder installed on the IIS server and is getting windows log.
I want to ingest IIS logs. have downloaded https://splunkbase.splunk.com/app/3185 and installed on search head
was referencing https://docs.splunk.com/Documentation/AddOns/released/MSIIS/Setupaddon
but it is showing invalid directory and i am stuck.
My questions is where all i have to install Add on only Search head because that was mentioned in Splunk document
Hi @sonishar,
as I already answered and also @isoutamo and @chaker said:
as you can read at https://docs.splunk.com/Documentation/AddOns/released/MSIIS/Install, you have to install this TA on the Search Heads for the search time parsing activities, but also on Indexers (for the indexes) and Heavy Forwarders (if present) and especially on the universal Forwarders where the logs are written.
Probably this is the reason of the invalid directory, because the TA doesn't find the IIS folder.
Ciao.
Giuseppe
This describes where you should install the addon. You should deploy a copy to the UF, with the correct input enabled, as per the link you originally posted.
https://docs.splunk.com/Documentation/AddOns/released/MSIIS/Install
Also take a look at this post, which is a similar question to yours.
https://community.splunk.com/t5/Getting-Data-In/IIS-Logs/m-p/517651/highlight/true#M87578
Hi
One hint what I have used with these TAs.
I install original TA as is to all places where it is needed (e.g. UF, SH). Then I have second TA which contains only those enabled inputs for that "master" TA. In that way I can use exact same TA package on all nodes UF, HF, IDX and SH. No need to remove local inputs when deploy this to another node types than UF. Also when a new release has launch it's enough to just install it to correct places and if I need a rollback just remove and install older versio.
r. Ismo