Splunk Search

Difference between input.conf and search results

isaacyeo
Engager

Hello,

This is my input.conf on the iis server:

[monitor://D:\IISLogs\W3SVC2]
index=iis_db
sourcetype=iis

However, this is my search result returns ii-2 instead of iis.
Is there a reason why the sourcetype in my search result is iis-2 instead of iis?

There are no changes to the index or sourcetype in transform.conf or props.conf.

0 Karma
1 Solution

lguinn2
Legend

IIS is a built-in sourcetype for Splunk. But IIS is not a simple sourcetype - it has many variants. So I often see that Splunk will assign a suffix to iis. You can expect to see iis-2, iis-3, etc. etc.

In Splunk 6, there are new ways to deal with IIS inputs. You might want to take a look at this blog entry:

IIS Logs and Splunk

View solution in original post

isaacyeo
Engager

Hi somesoni2, in props.conf, there are no changes being made to the sourcetype.

0 Karma

lguinn2
Legend

IIS is a built-in sourcetype for Splunk. But IIS is not a simple sourcetype - it has many variants. So I often see that Splunk will assign a suffix to iis. You can expect to see iis-2, iis-3, etc. etc.

In Splunk 6, there are new ways to deal with IIS inputs. You might want to take a look at this blog entry:

IIS Logs and Splunk

isaacyeo
Engager

Okay will try this out. Thanks again Iguinin.

0 Karma

lguinn2
Legend

You can. You could also use a sourcetype alias, which might be easier.

http://docs.splunk.com/Documentation/Splunk/6.1/Data/Renamesourcetypes

The docs link talks about how to do this by editing the config file, but it is really easy to do from the UI. As a Splunk admin, go to Manager -> Fields -> Sourcetype renaming

Use this to rename the iis-2 sourcetype to plain iis. You only need to do this once for each of the weird names that Splunk assigns...

The other nice thing about sourcetype renaming is that you don't have to re-index any data.

0 Karma

isaacyeo
Engager

I see. So in that case if I don't want it to be index this way, I should change the sourcetype to something else so that I can filter based on what I want?

0 Karma

lguinn2
Legend

Yes, although you obviously don't get the cool new ways to deal with the inputs. 😞

0 Karma

isaacyeo
Engager

Hi lguinn. Thanks for the reply. Is the assigning of suffix to iis happening for versions below 6? I am currently using 4.3.3.

0 Karma

somesoni2
Revered Legend

can you provide your sourcetype definition from props.conf as well?

0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...