iis server on board into splunk

[ramkilku]

Hello Professionals, we set up Splunk about 6 months ago, now we would like to onboard iis server to Splunk.May I know what exact procedure we have to follow in order to achieve this task

Thank you all

[esix_splunk · Accepted solution]

This is pretty straightforward. You need to deploy a UF onto your IIS Server and then deploy the Splunk Add-On for Microsoft IIS to the server. From that point, enable the inputs to read the IIS log files and mark the sourcetype properly.

This is outlined in the docs here : http://docs.splunk.com/Documentation/AddOns/released/MSIIS/Setupaddon

I would recommend using a Deployment Server to Manage your forwarders and push this app out to your IIS server(s).

Additionally, read through the notes and be aware that if you have modified any of the default fields, or added fields on the IIS side, you will need to modify the transforms for the extractions and update the fields.

[ramkilku]

Thank you sir, i appreciate for your quick response

[anjambha]

Hi ramkilku,

You can use ''Splunk Add-on for Microsoft IIS". Refer below link

link text