How do you check where an index is being sent to on an IIS Box ?

[itrimble1]

We have this on /etc/system/local for testing

Inputs.conf file

[default]

host = server name goes here

[monitor://C:\inetpub\logs\LogFiles\W3SVC1]
sourcetype = ms:iis:default
index = ms_iis

[woodcock]

Try these:

$SPLUNK_HOME/bin/splunk btool inputs list --debug
$SPLUNK_HOME/bin/splunk btool props list --debug

[anthonymelita]

You have that in the $SPLUNK_HOME/etcsystem/local, but if you chose to index IIS logs during the MSI install process then it will probably be in a different app under $SPLUNK_HOME/etc/apps

[lakshman239]

per the above, your sourcetype = ms:iis:default logs goes to index=ms_iis

you can search for index=ms_iss sourcetype=ms* to check all sourcetypes related to IIS logs.

[itrimble1]

I meant from the IIS Box. Which logs on the IIS box would tell me that it's going to the ms_iis index.

I am trying to troubleshoot, why they keep ending up in the catchall main index.

[somesoni2]

Run btool on the machine to see what index is actually applied. Other than then, you can look at metrics.log to see which index that sourcetype is going to.