IIS Logs not Parsing as expected

[djreschke]

I have a props conf file that is not parsing data as i expected. I can see in the raw log that the IIS log has the header information in it. 

[sourcetype]

DATETIME_CONFIG =
INDEXED_EXTRACTIONS = w3c
LINE_BREAKER = ([\r\n]+)
MAX_TIMESTAMP_LOOKAHEAD = 32
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Web
description = W3C Extended log format produced by the Microsoft Internet Information Services (IIS) web server
detect_trailing_nulls = auto
disabled = false
pulldown_type = true

When i manual upload the log file and assigning it to it will parse out the log with the same settings.

[sourcetypeA]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = w3c
LINE_BREAKER = ([\r\n]+)
MAX_TIMESTAMP_LOOKAHEAD = 32
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Web
description = W3C Extended log format produced by the Microsoft Internet Information Services (IIS) web server
detect_trailing_nulls = auto
disabled = false
pulldown_type = true

This props is on the searchhead were i am searching the data. The IIS logs is being capture via a UF.

Has anyone run into this before?

[djreschke · Accepted solution]

Needed to create a transforms to fix the issue.