Since our IIS log format changed, how do I tell Splunk to reindex IIS logs with a new format?

[JasonCarter80]

On a few of our IIS servers, some one checked off a few extra fields to be logged, which is not bad to have more information, but the problem is that Splunk is treating it like the old format.

There are 4 servers with the original setup, and 2 with the new setup.

How do I tell splunk to reprocess the logs from those two sources with a new format?

[lguinn2]

This is a particular problem with some types of logging: it's very typical for someone (like an IIS admin) to change stuff. To deal with this, Splunk 6 added a feature, which is described here: Extract data from files with headers

I would recommend this new feature for your IIS logs. (Use the INDEXED_EXTRACTIONS = W3C in your props.conf)
This way, you do not need to re-index your old data. Set this up and remove the data with the "new" setup (which is showing up wrong) and re-index just that data.

Once you have done this, going forward, Splunk will always examine the header of your IIS logs and figure out the right fields for the particular file. So no matter what the IIS admins do, you will be covered.

[RicoSuave]

Can you elaborate on what you mean by reprocess? I'm assuming you are looking to have splunk extract the new fields that are now in the logs that previously weren't. Is this correct?

[JasonCarter80]

Maybe not reprocess, but change the log type maybe? Its picking up the entire row including the new fields, but its combining some of the old data with the new data and its making my reports all jumbled.