All Apps and Add-ons

Splunk TA-Windows-Exchange-IIS vs sourcetype=IIS

BP9906
Builder

Hello,
I have the Splunk App for Exchange but Splunk documentation is unclear on how to handle my situation.
I have servers with IIS and thus IIS logs, so my generic ALL-WINDOWS server class detects the IIS logs and sets the sourcetype=iis so that all the fields get parsed properly.

The Splunk TA for Exchange IIS is here but obviously my Exchange_IIS Serverclass is lesser precedence. Regardless, it doesnt make sense that TA-Windows-Exchange-IIS sets sourcetype=MSWindows:2008R2:IIS when it misses out on the dynamic IIS log parsing.

How can I make all the Exchange dashboards properly populate using sourcetype=iis?

Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...