I currently have the Web Intelligence application set up to parse and generate reports off of my Apache logs. Works great, and the reports are very useful.
However, I'm attempting to add some IIS logs to the reports and I'm running into issues.
I modified the setup to include the sourcetypes that the IIS logs are stored under. I re-ran the backfill script for the last 24 hours, and everything seemed fine.
I then re-ran the sourcenames saved search to populate the lookup csv.
First issue:
The IIS logs get rotated. In the sourcenames.csv, can I use wildcards for the source?
Second issue:
The backfill script put everything in the summary indexes with the sourcename == source. So, when it runs the searches against the summary data, it's using the sourcename that I set in the sourcenames.csv and it's not finding anything.
Did I do something wrong?
... View more