I apologize if this has been asked before, I couldn't find it via the search/google/youtube.
I'm outputting IIS AppPool/Site configurations to text file (One for AppPools, and one for Sites), and ingesting them into splunk. For the life of me I cannot figure out how to get this to format correctly in splunk, or what I need to do in order to put it in a readable format that I can use to compare 2 IIS Configs against each other in a table. I'll share a test config file that I made, and maybe someone can tell me how I should be formatting it.
AppCmd does give you the option to export to XML, would this be an easier option for splunk to parse it correctly?
I would suggest trying the output as XML, in order to get more logical parsing out of the box for Splunk. Your observation is correct... the whole config IS a single entry. You are trying to compare the fields in one entry with the fields in another entry.
If this reply helps you, an upvote would be appreciated.