I am using Splunk Universal Forwarder to monitor IIS logfiles and send to Splunk Server. All of the fields are getting indexed and the data looks good when I do a search. Splunk automatically identifies the source type as IIS however the only fields I have are host, source and sourcetype. I'm running Splunk 6.2 on CentOS and the Splunk Universal Forwarder is running on a Windows box. When I was running in a test environment, I was able to suck in the same IIS logs and the proper fields were discovered and searchable. Nothing appears to be any different on the new server that I can see. Any guidance would be helpful and appreciated.
