Splunk Search

Difference between input.conf and search results

isaacyeo
Engager

Hello,

This is my input.conf on the iis server:

[monitor://D:\IISLogs\W3SVC2]
index=iis_db
sourcetype=iis

However, this is my search result returns ii-2 instead of iis.
Is there a reason why the sourcetype in my search result is iis-2 instead of iis?

There are no changes to the index or sourcetype in transform.conf or props.conf.

0 Karma
1 Solution

lguinn2
Legend

IIS is a built-in sourcetype for Splunk. But IIS is not a simple sourcetype - it has many variants. So I often see that Splunk will assign a suffix to iis. You can expect to see iis-2, iis-3, etc. etc.

In Splunk 6, there are new ways to deal with IIS inputs. You might want to take a look at this blog entry:

IIS Logs and Splunk

View solution in original post

isaacyeo
Engager

Hi somesoni2, in props.conf, there are no changes being made to the sourcetype.

0 Karma

lguinn2
Legend

IIS is a built-in sourcetype for Splunk. But IIS is not a simple sourcetype - it has many variants. So I often see that Splunk will assign a suffix to iis. You can expect to see iis-2, iis-3, etc. etc.

In Splunk 6, there are new ways to deal with IIS inputs. You might want to take a look at this blog entry:

IIS Logs and Splunk

isaacyeo
Engager

Okay will try this out. Thanks again Iguinin.

0 Karma

lguinn2
Legend

You can. You could also use a sourcetype alias, which might be easier.

http://docs.splunk.com/Documentation/Splunk/6.1/Data/Renamesourcetypes

The docs link talks about how to do this by editing the config file, but it is really easy to do from the UI. As a Splunk admin, go to Manager -> Fields -> Sourcetype renaming

Use this to rename the iis-2 sourcetype to plain iis. You only need to do this once for each of the weird names that Splunk assigns...

The other nice thing about sourcetype renaming is that you don't have to re-index any data.

0 Karma

isaacyeo
Engager

I see. So in that case if I don't want it to be index this way, I should change the sourcetype to something else so that I can filter based on what I want?

0 Karma

lguinn2
Legend

Yes, although you obviously don't get the cool new ways to deal with the inputs. 😞

0 Karma

isaacyeo
Engager

Hi lguinn. Thanks for the reply. Is the assigning of suffix to iis happening for versions below 6? I am currently using 4.3.3.

0 Karma

somesoni2
Revered Legend

can you provide your sourcetype definition from props.conf as well?

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...