Index issue - new logs - iis-2

[DanielFordWA]

Hi,

I have splunk sitting on a server indexing log files from a dir \weblog

When I initially added the folder all the logs were indexed and the data appears correctly, however the new logs are not being indexed.

The logs initially start at 0kb size and grow and then a new log is created every 10min, these logs are not being indexed.

I understand that the standard setting is to monitor the folder and as a log grows splunk will index the new information, this does not seem to be happening. I expect this is a basic error on my part.

They are iis-2 log format.

Hope you can help,

Dan

[starcher · Accepted solution]

Add the following to your props.conf. This will tell splunk that source type iis-2 logs are all coming in GMT timezone.

[iis-2]
tz=GMT

[DanielFordWA]

For a workaround I have change the user to GMT+1.

[DanielFordWA]

Hi Kristian thanks for the response.

I have discovered that Splunk does index the most recent logs which are created every 10mins, however these logs have a GMT time stamp, I am currently on BST (GMT +1).

The server Splunk sits on is also BST.

Therefore instead of a 10min delay it looks like a 1hr10mins delay, even though the logs are indexed every 10mins.

Is there an easy way to resolve this?

[kristian_kolb]

Please post the inputs.conf. Mask any servernames/internal data as needed.