If you are using Splunk 6 on both forwarder and indexer, you should try to take advantage of the headers feature we built that better understands IIS and W3C log formats.
http://docs.splunk.com/Documentation/Splunk/latest/Data/Extractfieldsfromfileheadersatindextime
If you are seeing this "iis-2" sourcetype, we are attempting to use the CHECK_FOR_HEADER feature which is deprecated as of Splunk 6 and never worked very well for this format.
On your forwarder, you should have in inputs.conf
[monitor:///path-to-directory]
sourcetype=iis
Under the covers, we are using props.conf to set INDEXED_EXTRACTIONS=W3C on the IIS sourcetype, ignore the first few lines of the header, and automatically map the fields found in the IIS header.
... View more