Well, just in case anyone bumps into this, I guess it was quite a newbie problem. I managed to do it by deploying to the forwarder (instead of the indexer) a props.conf file with a copy of the [iis] default stanza but with the different name [iis_group1] in the example. This way the w3c fields in iis_group1 should be automatically extracted.
... View more
hi, this is an old topic but I just found this exact same behavior. Has anyone ever found a justification for this? If I use sourcetype=iis, the w3c fields are automatically extracted. On the other hand, if I copy the [iis] stanza into my props.conf with another name and use this as the sourcetype, the fields are not extracted anymore.
... View more