Splunk Enterprise

Why after switching from HF to UF, MSWindows:2012:IIS event no longer parses correctly?

gitingua
Communicator

Hello colleagues. we recently switched from Splunk HF to UF. before this event with sourcetype = MSWindows:2012:IIS. parsed normal but after installation, something went wrong. and events in the spanner do not take all the fields from the logs

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@gitingua - If you are using the https://docs.splunk.com/Documentation/AddOns/released/MSIIS/Install Add-on for collecting and parsing the IIS logs then with UF Add-on requires to be installed on Indexers.

(I'm assuming UF is sending data directly to Indexers.)

VatsalJagani_0-1649349715138.png

I hope this helps, if it does consider upvoting!!!

0 Karma

gitingua
Communicator

@VatsalJagani  Hi. We use the app https://splunkbase.splunk.com/app/3225/
The problem is that there is a sourcetype=MSWindows:2012:IIS

But it is not described in the props file, it does not parse events, do you think need to change the application?

Tags (1)
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@gitingua - I would install the Add-on on Indexers still because it seems like Add-on definitely has some parsing configuration. Make sure to put Add-on on the UF as well.

(I'm assuming your UF is sending logs to Indexer directly.)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...