Monitoring Splunk

How to setup / migrate a few Web server logs into Splunk


How to setup / migrate a few Web server logs into Splunk. I need to set Splunk to ingest some web server logs into Splunk. Need step by step, if someone can help please

Labels (1)
Tags (1)
0 Karma


Hi @SamHTexas,

try to follow these preliminary steps:

To take logs you can use:

in the first case

In the second case you have to:

  • create by CLI (Universal Frwarders hasn't a web interface) your own inputs.conf in $SPLUNK_HOME\etc\system\local (or $SPLUNK_HOME/etc/system/local on Linux), containing:
disabled = false
sourcetype = ms:iis:auto
index = <preferred index>
  • Restart Splunk on Forwarder
  • check the logs.

I hint always the first one!

To better understand how to do this you can see

there are also some interesting videos in YouTube to do this.



0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!