Knowledge Management

TA for IIS that follows the Common Information Model

Motivator

Is there an addon(TA-iis perhaps) that follows the CIM for IIS logs?

1 Solution

SplunkTrust
SplunkTrust

The latest version of the app is ESS compatible and CIM compliant:

https://splunkbase.splunk.com/app/3185/

View solution in original post

SplunkTrust
SplunkTrust

The latest version of the app is ESS compatible and CIM compliant:

https://splunkbase.splunk.com/app/3185/

View solution in original post

Splunk Employee
Splunk Employee

Try this:

eventtypes.conf

[iis_events]
search = sourcetype=iis

tag=web

tags.conf

[eventtype=iis_events]
web = enabled

props.conf
[iis]
FIELDALIAS-c_ip = c_ip as src
FIELDALIAS-cs_Cookie = cs_Cookie as cookie
FIELDALIAS-cs_Referer = cs_Referer as http_referrer
FIELDALIAS-cs_User_Agent = cs_User_Agent as http_user_agent
FIELDALIAS-cs_bytes = cs_bytes as bytes_in
FIELDALIAS-s_ip = s_ip as dest
FIELDALIAS-cs_method = cs_method as http_method
FIELDALIAS-cs_uri_stem = cs_uri_stem as uri_path
FIELDALIAS-s_sitename = s_sitename as site
FIELDALIAS-sc_bytes = sc_bytes as bytes_out
FIELDALIAS-sc_status = sc_status as status
FIELDALIAS-cs_username = cs_username as user

Motivator

Created one myself.

Splunk Employee
Splunk Employee

How much is your TA?

0 Karma

New Member

Can you upload your TA or send me a copy so I don't have to reinvent the wheel?

0 Karma

Motivator

just an eventtype with a tab of web.
See:
http://docs.splunk.com/Documentation/CIM/latest/User/Web

0 Karma

Splunk Employee
Splunk Employee

Did you add anything else to this TA? Eventtypes, tags, etc?

0 Karma

Splunk Employee
Splunk Employee

+1 Thanks!

0 Karma

Motivator

I used the OOB w3c indexed extractions added FIELDALIAS's.

c_ip as src
cs_Cookie as cookie
cs_Referer as http_referrer
cs_User_Agent as http_user_agent
cs_bytes as bytes_in
s_ip as dest
cs_method as http_method
cs_uri_stem as uri_path
s_sitename as site
sc_bytes as bytes_out
sc_status as status
cs_username as user

0 Karma

Splunk Employee
Splunk Employee

Care to share your props?

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!