So bringing in some IIS logs from a few windows servers... seemed pretty simple. Installed the add-on for Micrsoft IIS which gave me a few new sourcetypes to use.
My inputs.conf reads (star.log is actually *.log):
index = iis
sourcetype = ms:iis:default
disabled = false
Event break are all chopped up. I looked at the source data from the IIS server and it looks like this (see image)
I also noticed that the hostname is coming in as "cs-method" and not the actual hostname. This server is sending in other logs from the splunk forwarder just fine, with the correct hostname.
Any pointers? Struggling here.
Splunk Enterprise v6.5.0
Your inputs.conf settings are fine. You'll want to take a look at the ./SplunkTAmicrosoft-iis/default/props.conf file on your search head. There's a bunch of over-ambitious FIELDALIAS commands there, and depending on exactly what fields you're logging from IIS, those FIELDALIAS commands can jack-up your field extractions.
I recommend commenting out this one:
FIELDALIAS-s_computername = s_computername as host
And either do a debug/refresh on your search head, or just restart the search head if that won't bum people out.
Once you've figured out which FIELDALIAS commands are the problem, you can actually override them in a ./SplunkTAmicrosoft-iis/local/props.conf file by setting them equal to nothing, like:
That's a better practice than making changes to the stuff in ./default.
I just went to the app in manage apps, viewed the objects, found the aforementioned field alias and unchecked the "Overwrite field values" box - on my search head. Now I see the right host names associated with the events.