Getting Data In

Splunk App for Web Intelligence: what should column names be for IIS log data?

stjack99
Explorer

I'm having a problem getting web intel app showing any results. I've investigated a bit, and think the problem is the column names I used.

This is what I currently have set:

iislogs

FIELDS = "date", "time", "s_siteName", "s_computername", "dest_ip", "http_method", "uri_stem", "uri_query", "dest_port", "user", "src_ip", "http_user_agent", "http_cookie", "http_referrer", "dest_host", "http_response", "http_sub_response", "sc_win32Status", "bytes_out", "bytes_in", "duration"

DELIMS = " "

What column names does web intel expect me to have?

0 Karma
1 Solution

stjack99
Explorer

Figured it out. For anyone else who wants a fix for this:

1) navigate to Manager » Fields » Field aliases

2) Click on each alias, and add a new alias

View solution in original post

MartinHarper
Path Finder

Here is a list of field aliases that may be needed, taken from [access-extractions] in default/transforms.conf

[access-extractions]
# matches access-common or access-combined apache logging formats
# Extracts: clientip, clientport, ident, user, req_time, method, uri, root, file, uri_domain, uri_query, version, status, bytes, referer_url, referer_domain, referer_proto, useragent, cookie, other (remaining chars)  
# Note: referer is misspelled in purpose because that is the "official" spelling for "HTTP referer" 
0 Karma

stjack99
Explorer

Figured it out. For anyone else who wants a fix for this:

1) navigate to Manager » Fields » Field aliases

2) Click on each alias, and add a new alias

CraigF
Explorer

What aliases did you add?

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...