Getting Data In

Search information from IIS logs

Path Finder

Hi Guys,

Do you know of a Splunk App that facilitates searching of IIS logs? Also is there a way I can parse logs to find out which users attempted to login to my IIS servers and if they were successful or not? Is there a custom search I can use?

Tags (2)
0 Karma
1 Solution

Super Champion

IIS logs are great fun to search, if the search time extractions are configured correctly in splunk. Unfortunately, the configuration often requires manual adjustments. Read this post, it contains pretty much everything you need to know.

http://answers.splunk.com/answers/24986/iis-log-fields-not-parsing

View solution in original post

0 Karma

Path Finder

Thanks this is great!

0 Karma

Super Champion

IIS logs are great fun to search, if the search time extractions are configured correctly in splunk. Unfortunately, the configuration often requires manual adjustments. Read this post, it contains pretty much everything you need to know.

http://answers.splunk.com/answers/24986/iis-log-fields-not-parsing

View solution in original post

0 Karma

Path Finder

Thanks so much!

0 Karma

Splunk Employee
Splunk Employee

Hi,

When you're asking about login to IIS, do you mean logging onto Windows, or logging into a web page/app?

If it's the former, then the Splunk App for Windows includes setup for looking at windows logins, if it's the latter, and you're recording authentication in the IIS logs, then the Splunk Add-on for Weblogs can help you set up field extractions for pulling out the user field, which should get you most of the way to a report on logged in users.

0 Karma