Getting Data In

Monitoring a folder that stores my IIS logs, why is a new Source created daily for each new IIS log file?

dglass0215
Path Finder

I have Splunk set to monitor the folder that stores my IIS logs. It is currently working, however, since there is a new log file created daily, each one is considered a source. So when I look at my data summary I have 215 sources and counting since each day a new one is added. Is this the way it is supposed to be?

Tags (3)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi dglass0215,

Yes, this is the way Splunk handles source files; it creates for each new file a field called source=NewFileName. Maybe you mixed it up with sourcetype? This should not be set to auto else it can happen, that Splunk creates new source types as well and this will make your life harder in creating fast performing searches.

Read the docs http://docs.splunk.com/Documentation/Splunk/6.2.2/Data/Whysourcetypesmatter?r=searchtip to get more details on this topic.

cheers, MuS

0 Karma

dglass0215
Path Finder

My sourcetype is correctly set to "iis". I just find it odd that I have a new source added each day. So that means after a year I will have 365 sources from monitoring the log file directory. Just seems silly to me. But thanks for your answer.

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...