TA for IIS that follows the Common Information Model

[aelliott]

Is there an addon(TA-iis perhaps) that follows the CIM for IIS logs?

[jkat54 · Accepted solution]

The latest version of the app is ESS compatible and CIM compliant:

https://splunkbase.splunk.com/app/3185/

[sjohnson_splunk]

Try this:

eventtypes.conf

[iis_events]
search = sourcetype=iis

tag=web

tags.conf

[eventtype=iis_events]
web = enabled

props.conf
[iis]
FIELDALIAS-c_ip = c_ip as src
FIELDALIAS-cs_Cookie = cs_Cookie as cookie
FIELDALIAS-cs_Referer = cs_Referer as http_referrer
FIELDALIAS-cs_User_Agent = cs_User_Agent as http_user_agent
FIELDALIAS-cs_bytes = cs_bytes as bytes_in
FIELDALIAS-s_ip = s_ip as dest
FIELDALIAS-cs_method = cs_method as http_method
FIELDALIAS-cs_uri_stem = cs_uri_stem as uri_path
FIELDALIAS-s_sitename = s_sitename as site
FIELDALIAS-sc_bytes = sc_bytes as bytes_out
FIELDALIAS-sc_status = sc_status as status
FIELDALIAS-cs_username = cs_username as user

[aelliott]

Created one myself.

[rroberts]

How much is your TA?

[asonenthal]

Can you upload your TA or send me a copy so I don't have to reinvent the wheel?

[aelliott]

just an eventtype with a tab of web.
See:
http://docs.splunk.com/Documentation/CIM/latest/User/Web

[aaronkorn]

Did you add anything else to this TA? Eventtypes, tags, etc?

[aaronkorn]

+1 Thanks!

[aelliott]

I used the OOB w3c indexed extractions added FIELDALIAS's.

c_ip as src
cs_Cookie as cookie
cs_Referer as http_referrer
cs_User_Agent as http_user_agent
cs_bytes as bytes_in
s_ip as dest
cs_method as http_method
cs_uri_stem as uri_path
s_sitename as site
sc_bytes as bytes_out
sc_status as status
cs_username as user

[aaronkorn]

Care to share your props?