Splunk Search

Difference between input.conf and search results

Engager

Hello,

This is my input.conf on the iis server:

[monitor://D:\IISLogs\W3SVC2]
index=iis_db
sourcetype=iis

However, this is my search result returns ii-2 instead of iis.
Is there a reason why the sourcetype in my search result is iis-2 instead of iis?

There are no changes to the index or sourcetype in transform.conf or props.conf.

0 Karma
1 Solution

Legend

IIS is a built-in sourcetype for Splunk. But IIS is not a simple sourcetype - it has many variants. So I often see that Splunk will assign a suffix to iis. You can expect to see iis-2, iis-3, etc. etc.

In Splunk 6, there are new ways to deal with IIS inputs. You might want to take a look at this blog entry:

IIS Logs and Splunk

View solution in original post

Engager

Hi somesoni2, in props.conf, there are no changes being made to the sourcetype.

0 Karma

Legend

IIS is a built-in sourcetype for Splunk. But IIS is not a simple sourcetype - it has many variants. So I often see that Splunk will assign a suffix to iis. You can expect to see iis-2, iis-3, etc. etc.

In Splunk 6, there are new ways to deal with IIS inputs. You might want to take a look at this blog entry:

IIS Logs and Splunk

View solution in original post

Engager

Okay will try this out. Thanks again Iguinin.

0 Karma

Legend

You can. You could also use a sourcetype alias, which might be easier.

http://docs.splunk.com/Documentation/Splunk/6.1/Data/Renamesourcetypes

The docs link talks about how to do this by editing the config file, but it is really easy to do from the UI. As a Splunk admin, go to Manager -> Fields -> Sourcetype renaming

Use this to rename the iis-2 sourcetype to plain iis. You only need to do this once for each of the weird names that Splunk assigns...

The other nice thing about sourcetype renaming is that you don't have to re-index any data.

0 Karma

Engager

I see. So in that case if I don't want it to be index this way, I should change the sourcetype to something else so that I can filter based on what I want?

0 Karma

Legend

Yes, although you obviously don't get the cool new ways to deal with the inputs. 😞

0 Karma

Engager

Hi lguinn. Thanks for the reply. Is the assigning of suffix to iis happening for versions below 6? I am currently using 4.3.3.

0 Karma

SplunkTrust
SplunkTrust

can you provide your sourcetype definition from props.conf as well?

0 Karma