Getting Data In
Highlighted

Windows IIS logs not formatting correctly / hostname problem

Path Finder

So bringing in some IIS logs from a few windows servers... seemed pretty simple. Installed the add-on for Micrsoft IIS which gave me a few new sourcetypes to use.

My inputs.conf reads (star.log is actually *.log):
[monitor://C:\inetpub\logs\LogFiles\W3SVC1\star.log]
index = iis
sourcetype = ms:iis:default
disabled = false

Event break are all chopped up. I looked at the source data from the IIS server and it looks like this (see image)

I also noticed that the hostname is coming in as "cs-method" and not the actual hostname. This server is sending in other logs from the splunk forwarder just fine, with the correct hostname.

Any pointers? Struggling here.

Thanks!

Joe

Splunk Enterprise v6.5.0

Highlighted

Re: Windows IIS logs not formatting correctly / hostname problem

Path Finder
0 Karma
Highlighted

Re: Windows IIS logs not formatting correctly / hostname problem

Communicator

Your inputs.conf settings are fine. You'll want to take a look at the ./SplunkTAmicrosoft-iis/default/props.conf file on your search head. There's a bunch of over-ambitious FIELDALIAS commands there, and depending on exactly what fields you're logging from IIS, those FIELDALIAS commands can jack-up your field extractions.

I recommend commenting out this one:

FIELDALIAS-s_computername = s_computername as host

And either do a debug/refresh on your search head, or just restart the search head if that won't bum people out.

Highlighted

Re: Windows IIS logs not formatting correctly / hostname problem

Communicator

Once you've figured out which FIELDALIAS commands are the problem, you can actually override them in a ./SplunkTAmicrosoft-iis/local/props.conf file by setting them equal to nothing, like:

FIELDALIAS-s_computername = 

That's a better practice than making changes to the stuff in ./default.

0 Karma
Highlighted

Re: Windows IIS logs not formatting correctly / hostname problem

Explorer

I just went to the app in manage apps, viewed the objects, found the aforementioned field alias and unchecked the "Overwrite field values" box - on my search head. Now I see the right host names associated with the events.