Getting Data In

Windows IIS logs not formatting correctly / hostname problem

joesrepsol
Path Finder

So bringing in some IIS logs from a few windows servers... seemed pretty simple. Installed the add-on for Micrsoft IIS which gave me a few new sourcetypes to use.

My inputs.conf reads (star.log is actually *.log):
[monitor://C:\inetpub\logs\LogFiles\W3SVC1\star.log]
index = iis
sourcetype = ms:iis:default
disabled = false

Event break are all chopped up. I looked at the source data from the IIS server and it looks like this (see image)

I also noticed that the hostname is coming in as "cs-method" and not the actual hostname. This server is sending in other logs from the splunk forwarder just fine, with the correct hostname.

Any pointers? Struggling here.

Thanks!

Joe

Splunk Enterprise v6.5.0

adobrzeniecki
Path Finder

I am also having issues with the host field appearing when i run a search for this data. I commented out the field alias in props and for some reason the host field still does not exist in the search. When running a tstats on the index by host we see values for host. But not when we just simply search the data

0 Karma

gpullis
Communicator

Your inputs.conf settings are fine. You'll want to take a look at the ./Splunk_TA_microsoft-iis/default/props.conf file on your search head. There's a bunch of over-ambitious FIELDALIAS commands there, and depending on exactly what fields you're logging from IIS, those FIELDALIAS commands can jack-up your field extractions.

I recommend commenting out this one:

FIELDALIAS-s_computername = s_computername as host

And either do a debug/refresh on your search head, or just restart the search head if that won't bum people out.

cjpote
Explorer

I just went to the app in manage apps, viewed the objects, found the aforementioned field alias and unchecked the "Overwrite field values" box - on my search head. Now I see the right host names associated with the events.

gpullis
Communicator

Once you've figured out which FIELDALIAS commands are the problem, you can actually override them in a ./Splunk_TA_microsoft-iis/local/props.conf file by setting them equal to nothing, like:

FIELDALIAS-s_computername = 

That's a better practice than making changes to the stuff in ./default.

0 Karma

joesrepsol
Path Finder

alt text

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...