I'm writing an Add-on script for the universal forwarder that will read several log files containing complex data and reformat the data so that Splunk can more easily parse it. Does my script need to implement it's own logic for "where it left off last time it was invoked" or does Splunk help with that somehow? In other words, is it possible to have 'monitor' functionality, but with my own custom script? Thanks. ... View more

Please advise. Linux Splunk Server 4.1.5 Light forwarder is installed on Windows IIS web Servers Trying to get W3C Extended fields available for searching on the Splunk Server. the data is forwarded, just not with fields defined. Windows IIS Servers have this inputs.conf [default] host = servername [monitor://C:\WINNT\system32\LogFiles\W*\ex*.log] SOURCETYPE = iis Records also display with source types "IIS" "IIS-1" IIS-5" on the Splunk server. What the best way to configure this to the IIS logs have their W#C Extended fields available for searching? thanks. ... View more