IIS logs are great fun to search, if the search time extractions are configured correctly in splunk. Unfortunately, the configuration often requires manual adjustments. Read this post, it contains pretty much everything you need to know.
http://answers.splunk.com/answers/24986/iis-log-fields-not-parsing
Thanks this is great!
IIS logs are great fun to search, if the search time extractions are configured correctly in splunk. Unfortunately, the configuration often requires manual adjustments. Read this post, it contains pretty much everything you need to know.
http://answers.splunk.com/answers/24986/iis-log-fields-not-parsing
Thanks so much!
Hi,
When you're asking about login to IIS, do you mean logging onto Windows, or logging into a web page/app?
If it's the former, then the Splunk App for Windows includes setup for looking at windows logins, if it's the latter, and you're recording authentication in the IIS logs, then the Splunk Add-on for Weblogs can help you set up field extractions for pulling out the user field, which should get you most of the way to a report on logged in users.