Search information from IIS logs

[tbalouch]

Hi Guys,

Do you know of a Splunk App that facilitates searching of IIS logs? Also is there a way I can parse logs to find out which users attempted to login to my IIS servers and if they were successful or not? Is there a custom search I can use?

[tbalouch]

Thanks this is great!

[lukejadamec · Accepted solution]

IIS logs are great fun to search, if the search time extractions are configured correctly in splunk. Unfortunately, the configuration often requires manual adjustments. Read this post, it contains pretty much everything you need to know.

http://answers.splunk.com/answers/24986/iis-log-fields-not-parsing

[tbalouch]

Thanks so much!

[dart]

Hi,

When you're asking about login to IIS, do you mean logging onto Windows, or logging into a web page/app?

If it's the former, then the Splunk App for Windows includes setup for looking at windows logins, if it's the latter, and you're recording authentication in the IIS logs, then the Splunk Add-on for Weblogs can help you set up field extractions for pulling out the user field, which should get you most of the way to a report on logged in users.