Getting Data In

Index issue - new logs - iis-2

DanielFordWA
Contributor

Hi,

I have splunk sitting on a server indexing log files from a dir \weblog

When I initially added the folder all the logs were indexed and the data appears correctly, however the new logs are not being indexed.

The logs initially start at 0kb size and grow and then a new log is created every 10min, these logs are not being indexed.

I understand that the standard setting is to monitor the folder and as a log grows splunk will index the new information, this does not seem to be happening. I expect this is a basic error on my part.

They are iis-2 log format.

Hope you can help,

Dan

Tags (3)
0 Karma
1 Solution

starcher
SplunkTrust
SplunkTrust

Add the following to your props.conf. This will tell splunk that source type iis-2 logs are all coming in GMT timezone.

[iis-2]
tz=GMT

View solution in original post

starcher
SplunkTrust
SplunkTrust

Add the following to your props.conf. This will tell splunk that source type iis-2 logs are all coming in GMT timezone.

[iis-2]
tz=GMT

DanielFordWA
Contributor

For a workaround I have change the user to GMT+1.

0 Karma

DanielFordWA
Contributor

Hi Kristian thanks for the response.

I have discovered that Splunk does index the most recent logs which are created every 10mins, however these logs have a GMT time stamp, I am currently on BST (GMT +1).

The server Splunk sits on is also BST.

Therefore instead of a 10min delay it looks like a 1hr10mins delay, even though the logs are indexed every 10mins.

Is there an easy way to resolve this?

0 Karma

kristian_kolb
Ultra Champion

Please post the inputs.conf. Mask any servernames/internal data as needed.

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Spunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...