This mount option resolved the issue for me. I have a similar configuration, a CIFS share mounted on a CentOS 5.9 server. ... View more

I found out why this is happening - though I do not have a good answer on how to fix. <-------basically the IIS log Starts at midnight (or your time setting)-------> ' #Software: Microsoft Internet Information Services 7.5 ' #Version: 1.0 ' #Date: 2015-06-03 00:00:00 ' #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status time-taken ' then log data occurs LOGS LOGS LOGS DATA HOST LATENCY YADDA YADDA ETC <-------later in the day the headers appear again-------> ' continued from above log data occurs LOGS LOGS LOGS DATA HOST LATENCY YADDA YADDA ETC Software: Microsoft Internet Information Services 7.5 Version: 1.0 <------- this is where the splunk forwarder parses the log and creates "Source type iis-# -------> Date: 2015-06-03 00:00:00 Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status time-taken ' continued from above log data occurs LOGS LOGS LOGS DATA HOST LATENCY YADDA YADDA ETC this will be the standard until a new IIS log is created - VICIOUS CYCLE REPEATS UNTIL ADMIN GOES CRAZY AND MOVES TO MEXICO ... View more

To add a bit more detail since I had to explain how this works to our Unix admins, here is IBM's link about the System Resource Controller: [1]: http://www-01.ibm.com/support/knowledgecenter/ssw_aix_61/com.ibm.aix.cmds5/startsrc.htm Not sure why Splunk went this way in the first place and forked AIX in this manner. ... View more