IIS Logs are not showing up in reports for Web Intelligence

[Brian_Osburn]

I currently have the Web Intelligence application set up to parse and generate reports off of my Apache logs. Works great, and the reports are very useful.

However, I'm attempting to add some IIS logs to the reports and I'm running into issues.

I modified the setup to include the sourcetypes that the IIS logs are stored under. I re-ran the backfill script for the last 24 hours, and everything seemed fine.

I then re-ran the sourcenames saved search to populate the lookup csv.

First issue:

The IIS logs get rotated. In the sourcenames.csv, can I use wildcards for the source?

Second issue:

The backfill script put everything in the summary indexes with the sourcename == source. So, when it runs the searches against the summary data, it's using the sourcename that I set in the sourcenames.csv and it's not finding anything.

Did I do something wrong?

[araitz · Accepted solution]

Unfortunately, wildcards don't work in lookups such as sourcenames.csv without some gymnastics. We are planning on improving the workflow for setting up the lookup in question.

Regarding the second issue, I'm not 100% clear on what is happening. The summary index data has source=foo123*. What are the searches looking for?

[araitz]

This is something we intend to address in a forthcoming release of the web intelligence app.

[gerald_huddlest]

with regard to the IIS logs rotating, was there any further advise on this?

[Brian_Osburn]

Hrrm.. So I'll pretty much have to go in and edit the sourcenames.csv every day because the files rotate?

With regards to the second issue:
From what I understand, the searches use the sourcenames.csv to get whatever name we assign to it that source (for example, www.websitename.com). It then uses that to search the WI* summary indexes for sourcename=www.websitename.com. BUT, in the summary indexes, the sourcename has been set to the actual log location (aka the first column in the sourcenames.csv).

Did that make it clearer?