Multiple File Locations to Single Sourcetype

[ltrand]

I currently have two methods of collecting IIS logs, Syslog & UF. As IIS can have multiple log locations depending on version, we have specified many different locations for the inputs.conf and are trying to point all sources at a single sourcetype & index, IIS. Unfortunately Splunk is giving us IIS, IIS-2, and IIS-####. We can't seem to locate the configuration item that is splitting this out.

For syslog I have syslog-ng parsing the incoming data and dumping it to a file on a forwarder to which splunk then picks up and indexes. This is used extensively and works flawlessly with other data, however for IIS logs, syslog is giving these the autonaming of IIS-# (mostly IIS-2, but not all). We have a single configuration stanza for this that specifies %SyslogHome/IIS/%HostIP/%Date.log as the source.

For UF we are using inputs.conf to define the IIS log locations and assign them as ISS. Two examples:

[monitor://C:\windows\system32\LogFiles\W3SVC1*.log]
disabled = 0
sourcetype = iis
index = idx_iis

[monitor://C:\inetpub\logs\LogFiles\W3SVC1*.log]
disabled = 0
sourcetype = iis
index = idx_iis

So the question; why, and via what configuration, is Splunk renaming some of the logs? We are seeing sources and hosts in sourcetype=IIS. We even have hosts logging into sourcetype=IIS as well as IIS-#.

Thanks!

[bshuler_splunk · Accepted solution]

Specifically, in the version of splunk you are using, iis a learned source type. Because the iis admin can change the log file format at will, splunk looks at the file header, records what it sees, and records the source type as iis-1. Once you change the fields, you get iis-2. If you change it back, you get iis-1 again.

The details of the fix are here: http://blogs.splunk.com/2013/10/18/iis-logs-and-splunk-6/

[bshuler_splunk]

Upgrade, that has been fixed in the latest version.

[ltrand]

Thanks bshuler,

I was wondering if you could elaborate on the root cause of the issue? We're still a bit aways from being ready to upgrade and would like to hand-jam a solution if there is one.