Getting Data In

Windows IIS logs not formatting correctly / hostname problem

joesrepsol
Path Finder

So bringing in some IIS logs from a few windows servers... seemed pretty simple. Installed the add-on for Micrsoft IIS which gave me a few new sourcetypes to use.

My inputs.conf reads (star.log is actually *.log):
[monitor://C:\inetpub\logs\LogFiles\W3SVC1\star.log]
index = iis
sourcetype = ms:iis:default
disabled = false

Event break are all chopped up. I looked at the source data from the IIS server and it looks like this (see image)

I also noticed that the hostname is coming in as "cs-method" and not the actual hostname. This server is sending in other logs from the splunk forwarder just fine, with the correct hostname.

Any pointers? Struggling here.

Thanks!

Joe

Splunk Enterprise v6.5.0

adobrzeniecki
Path Finder

I am also having issues with the host field appearing when i run a search for this data. I commented out the field alias in props and for some reason the host field still does not exist in the search. When running a tstats on the index by host we see values for host. But not when we just simply search the data

0 Karma

gpullis
Communicator

Your inputs.conf settings are fine. You'll want to take a look at the ./Splunk_TA_microsoft-iis/default/props.conf file on your search head. There's a bunch of over-ambitious FIELDALIAS commands there, and depending on exactly what fields you're logging from IIS, those FIELDALIAS commands can jack-up your field extractions.

I recommend commenting out this one:

FIELDALIAS-s_computername = s_computername as host

And either do a debug/refresh on your search head, or just restart the search head if that won't bum people out.

cjpote
Explorer

I just went to the app in manage apps, viewed the objects, found the aforementioned field alias and unchecked the "Overwrite field values" box - on my search head. Now I see the right host names associated with the events.

gpullis
Communicator

Once you've figured out which FIELDALIAS commands are the problem, you can actually override them in a ./Splunk_TA_microsoft-iis/local/props.conf file by setting them equal to nothing, like:

FIELDALIAS-s_computername = 

That's a better practice than making changes to the stuff in ./default.

0 Karma

joesrepsol
Path Finder

alt text

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...