Getting Data In

Indexing and extracting fields from IIS 7.5 logs

Path Finder

Hello
I am having a difficult time getting Splunk to recognize fields from my IIS 7.5 logs. I know that there are many, many posts in splunk-base regarding this - I have looked through many of them and tried the suggested answers in at least 8-10 different posts. None of them have worked for me, eventhough I don't have a custom config - just a standard IIS server with logging enabled and default fields selected. The files get indexed, but the fields are not recognized (i.e. I cannot simply search for "time-taken > 50" within the data indexed from these logs)

Here is my full config:

Splunk versions:
Client UF: 4.3.3
Intermediary UF: 4.3.3
Indexer: 4.3.4

Client UF sends data to intermediary UF, which sends it to the indexer.

My config current config (and last attempt to make this work) on the Client UF is:

C:\Program Files\SplunkUniversalForwarder\etc\apps\app_A\default\inputs.conf

[monitor://C:\inetpub\logs]
disabled = false
followTail = 0
sourcetype = iisw3c
index = testindex

C:\Program Files\SplunkUniversalForwarder\etc\apps\app_A\default\props.conf

[iisw3c]
pulldown_type = true
MAX_TIMESTAMP_LOOKAHEAD = 32
SHOULD_LINEMERGE = False
CHECK_FOR_HEADER = true
TZ = GMT
REPORT-iisw3cfields = iisw3cfields
TRANSFORMS-removecomments = removecomments

C:\Program Files\SplunkUniversalForwarder\etc\apps\app_A\default\transforms.conf

[removecomments]
REGEX = ^\#.*
DEST_KEY = queue
FORMAT = nullQueue

[iisw3cfields]
DELIMS = " "
FIELDS = date, time, s-sitename, s-computername, s-ip, cs-method, cs-uri-stem, cs-uri-query, s-port, cs-username, c-ip, cs-version, cs(User-Agent), cs(Cookie), cs(Referer), cs-host, sc-status, sc-substatus, sc-win32-status, sc-bytes, cs-bytes, time-taken

What I am doing wrong?

Thanks in advance!

Tags (3)
0 Karma
1 Solution

Contributor

Props and Transforms should be on the searchheads, not the UF

View solution in original post

Contributor

Props and Transforms should be on the searchheads, not the UF

View solution in original post

Path Finder

OK, I added the files to the .\Splunk\etc\system\local directory of the indexer/search head and it is working! I wish I had asked this earlier... 🙂 Thank you!

0 Karma

Path Finder

That makes sense... 🙂 Which directory should I place them in?

0 Karma

Path Finder

To clarify the path of the logs in my above post - it is:

C:\Program Files\SplunkUniversalForwarder\etc\apps\app_A\default

0 Karma