I was having the same issue, ended up leaving all the options blank during the install and then it managed to complete without issue. Just means you have to set set the index server, etc, manually in the conf files, but I just copied them from a working system without any issue. ... View more

OK, makes a bit more sense now. One question, is IIS advanced the same as IIS only better? Meaning, I am able to extract the same thing with advanced as I can with basic IIS logging. However, advanced can the extract more. I guess what I am asking is, do I need both for the same server? I assume no as advanced allows the re-ordering as you suggest. I would think the best practice would be to always move commonly empty fields to the end? Lastly, when it comes to IIS logging, is there stuff that is just garbage (not needed) vs the must have fields to log? Thanks! ... View more

when you say cs_User_Agent doesnt extract well at times, where is this pulling from? Also, what are the advanced logs? I only have the w3c logs, unless of course I am looking in the wrong place. In IIS there is only the one log setting, so surely there is another spot. ... View more

Awesome work, the LINE_BREAKER works. Before you posted that, I also figured out how to do it with the FIELDALIAS and then EVAL null the original values, like this: #[WS_FTP] #BREAK_ONLY_BEFORE = <entry> #DATETIME_CONFIG = #NO_BINARY_CHECK = true #TIME_FORMAT = %Y%m%d-%H:%M:%S #TIME_PREFIX = \<log_time\> #FIELDALIAS-rootfields = entry.log_time as Time entry.description as Description entry.user as User entry.cmd as Command entry.service as Service entry.severity as Severity entry.sguid as SGUID entry.host as Host entry.sessionid as Session_ID entry.type as Type #EVAL-entry.log_time = null #EVAL-entry.description = null #EVAL-entry.user = null #EVAL-entry.cmd = null #EVAL-entry.service = null #EVAL-entry.severity = null #EVAL-entry.sguid = null #EVAL-entry.host = null #EVAL-entry.sessionid = null #EVAL-entry.type = null #KV_MODE = xml In the end, both seem to work, but the key was the main extract so thanks a million ... View more

I was curious, is there any way to make the search time rename a permanent thing? I did the field alias, but I end up with the entry.description and Description then. I was looking at the docs, but nothing was super obvious. Hoping this too is something simple. ... View more

super awesome, this worked. Fields extracted as you noted. I added the below field alias, but then I ended up with both the formatted and unformatted fields. Not sure if I will keep it or just add the search time rename as noted below. FIELDALIAS-rootfields = entry.log_time as Time entry.description as Description entry.user as User entry.cmd as Command entry.service as Service entry.severity as Severity entry.sguid as SGUID For the record, I want to make sure I put this into the correct props.conf file. I added it under system as there is no app for ws_ftp to add it to. Or should it go under the search app? ... View more

I am running this instance on Windows and I had to reset some permissions and eventually things came back online. Back at the start of November when this happened I messed with folder security and ran a repair. Specifically what fixed it I do not recall, but i know it didnt like something with one of the folders. I believe in the end I force updated the entire folder structure permissions to get things online again. I can report that i just went to 6.5.1 and it had no such issue, so it is not clear what 6.5 did. ... View more

2016-11-03 09:24:11,007 INFO [581b3a7b00fa77dedba8] decorators:363 - require_login - no splunkd sessionKey variable set; cherrypy_session=0ba7867df50418e24478e9822ccfa10e56646aa2 request_path=/en-US/ 2016-11-03 09:24:11,007 INFO [581b3a7b00fa77dedba8] decorators:384 - require_login - redirecting to login 2016-11-03 09:24:11,499 INFO [581b3a7b7cfa77ded438] error:138 - Masking the original 404 message: 'The path '/en-US/static/@02E046AB149829BCBA669025F6BF0A1462C97FF999C33E1997531404F814356C/build/css/bootstrap-enterprise.css' was not found.' with 'Page not found!' for security reasons 2016-11-03 09:24:11,546 INFO [581b3a7b84fa77ded9e8] error:138 - Masking the original 404 message: 'The path '/en-US/static/@02E046AB149829BCBA669025F6BF0A1462C97FF999C33E1997531404F814356C/js/i18n.js' was not found.' with 'Page not found!' for security reasons 2016-11-03 09:24:11,551 INFO [581b3a7b85fa77e250f0] error:138 - Masking the original 404 message: 'The path '/en-US/static/@02E046AB149829BCBA669025F6BF0A1462C97FF999C33E1997531404F814356C/build/pages/enterprise/common.js' was not found.' with 'Page not found!' for security reasons 2016-11-03 09:24:11,551 INFO [581b3a7b85fa77e25208] error:138 - Masking the original 404 message: 'The path '/en-US/static/@02E046AB149829BCBA669025F6BF0A1462C97FF999C33E1997531404F814356C/build/pages/enterprise/account.js' was not found.' with 'Page not found!' for security reasons 2016-11-03 09:24:11,568 INFO [581b3a7b8ffa77dedb38] error:138 - Masking the original 404 message: 'The path '/en-US/static/@02E046AB149829BCBA669025F6BF0A1462C97FF999C33E1997531404F814356C/build/pages/enterprise/account.js' was not found.' with 'Page not found!' for security reasons 2016-11-03 09:24:16,122 INFO [581b3a801dfa77ded9e8] error:138 - Masking the original 404 message: 'The path '/en-US/static/@02E046AB149829BCBA669025F6BF0A1462C97FF999C33E1997531404F814356C/build/css/bootstrap-enterprise.css' was not found.' with 'Page not found!' for security reasons 2016-11-03 09:24:16,428 INFO [581b3a8063fa77ded6d8] error:138 - Masking the original 404 message: 'The path '/en-US/static/@02E046AB149829BCBA669025F6BF0A1462C97FF999C33E1997531404F814356C/js/i18n.js' was not found.' with 'Page not found!' for security reasons 2016-11-03 09:24:16,428 INFO [581b3a8063fa77e32240] error:138 - Masking the original 404 message: 'The path '/en-US/static/@02E046AB149829BCBA669025F6BF0A1462C97FF999C33E1997531404F814356C/build/pages/enterprise/common.js' was not found.' with 'Page not found!' for security reasons 2016-11-03 09:24:16,430 INFO [581b3a8064fa77e32160] error:138 - Masking the original 404 message: 'The path '/en-US/static/@02E046AB149829BCBA669025F6BF0A1462C97FF999C33E1997531404F814356C/build/pages/enterprise/account.js' was not found.' with 'Page not found!' for security reasons ... View more

OK, so I started over, so as to make sure I didnt have something screwed up. I installed just the one plug-in 2.0.1and enabled the universal forwarder on my management server. The issue with this plugin is that it has no GUI and it is not visible by default. The other noted plugin has an interface page and is visible up install. Therefore, my only thought is that I need both, but thats how I had it before when I was not seeing any data. ... View more