With IIS I found the best option was to force the iis sourcetype for all inputs, and have a standard logging in place. By default, I use "all" of the fields. That way, it's the same fields all the time no matter what IIS server is logging. There is a brief cutover time associated with this method, as the extractions don't work for the old sourcetypes, but it simplified the whole "this iis is different than that iis". IIS is IIS for me. Changing sourcetype mid-file isn't an option, as far as I know. Hence why I standardized the output and make sure it's followed. ... View more

While Splunk Doesn't allow spaces in the fields (see url below) it might replace the spaces with an underscore. So your field to search on would be " Service_Error_Type ", etc for each of those fields. http://docs.splunk.com/Documentation/Splunk/5.0.3/Knowledge/Aboutfields ... View more

I have this setup. You can put it into $SPLUNK_HOME/etc/system/local/props.conf and it should work. You may want to have your field called "b" or "bytes" for it to work, or change the config to match your fields. This will auto-calculate kilos, megas and gigas automatically. [host::*] priority = 100 EVAL-kilobytes = if(isnotnull(kilobytes),kilobytes,bytes/1024) EVAL-megabytes = if(isnotnull(megabytes),megabytes,bytes/1024/1024) EVAL-gigabytes = if(isnotnull(gigabytes),gigabytes,bytes/1024/1024/1024) EVAL-kb = if(isnotnull(kb),kb,b/1024) EVAL-mb = if(isnotnull(mb),mb,b/1024/1024) EVAL-gb = if(isnotnull(gb),gb,b/1024/1024/1024) You can also use a macro (in the Search UI): Manager -> Advanced Search -> Search Macros Name: resize(1) Arguments: bytes definition = eval kilobytes = $bytes$/1024| eval megabytes=kilobytes/1024|eval gigabytes/1024 Then you can do your_search | resize(fs) ... View more

Based on the comment under jtrucks answer: http_status="500" |eventstats count as TOTAL_COUNT| stats latest(TOTAL_COUNT) as TC count by client_address, url, server_name, http_status_description, http_method, http_version, user_agent, referrer | where TC > 100 Ref: http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Eventstats ... View more

It all depends on how you stack the licenses. If you have a single license master with all the licenses installed, and carved up, a global blackout would be caused by 5 violations. If you have multiple license masters, then you would have individual license blackouts. You can also get a reset license rather quickly if you need it. I would also suggest a "Dev license" (10GB) for use in your Dev Environment. That way you don't have to worry about dev impacting prod. ... View more