index.conf wildcards don't seem to work

[kmower]

I have set up the Universal Forwarder on a few machines with iis web servers. iis splits the logs into separate folders for the different 'sites' on iis for W3SVC logs. These are numbered sequentially like W3SVC1, W3SVC2, W3SVC3, etc.

My issue is trying to use a combination of wildcards as documented: https://docs.splunk.com/Documentation/Splunk/latest/Data/Specifyinputpathswithwildcards but I am only getting one WSVC log directory getting indexed. I have tried a few formats with wildcards, but for this particular server I am only getting back W3SVC1 and not from W3SVC2, even though there are logs within W3SVC2 that are within my ignoreolderThan timespan (120d).

I have also set up forwarder management, and have included a serverclass. Everything looks OK, but I am not getting the logs from W3SVC2. For example, I have tried:

[default]
host = INS-PURE01-PREP

[monitor://C:\inetpub\logs\LogFiles\W3SVC*\*]
index = weblogs
sourcetype = iis
ignoreOlderThan = 120d
disabled = false

I have also tried

[default] host = INS-PURE01-PREP

[monitor://C:\inetpub\logs\LogFiles\...\*]
index = weblogs sourcetype = iis
ignoreOlderThan = 120d
disabled = false

... and I have also tried

[default]
host = INS-PURE01-PREP

[monitor://C:\inetpub\logs\LogFiles\*]
index = weblogs
sourcetype = iis
ignoreOlderThan = 120d
disabled = false

None of them are getting the W3SVC2 directory pushed/pulled into splunk for indexing. Is this a problem with the Universal Forwarder of Windows? Of course these are all Windows Boxes, including the deployment manager of course. Do I have to explicitly declare a monitor for each of the W3SVC directories? I would like to avoid that as I would like to use the deployment manager model and just have every log in one of the W3SVC# directories within C:\inetpub\logs\LogFiles get indexed by Splunk.

I have read existing posts and searched all over, but I can't see anywhere why this is not working. Thank you.

[nickhills]

Wildcards in monitor stanzas work, but where there are a large number of files to monitor, it is better to be more specific if you can.

I would be tempted to add 3 monitors:

[monitor://C:\inetpub\logs\LogFiles\W3SVC1]
[monitor://C:\inetpub\logs\LogFiles\W3SVC2]
[monitor://C:\inetpub\logs\LogFiles\W3SVC3]

and repeat the configuration for each.

I can't immediately see why your config would not work, but perhaps validate that your Splunk user does indeed have permissions to read from folder 2 and 3

[whrg]

Hello @kmower,

I can't find anything wrong with your logic.
However, I suggest you use the Splunk Add-on for Microsoft IIS:
https://splunkbase.splunk.com/app/3185/

You will need to place it on your Universal Forwarder + search head + heavy forwarder/indexer.

The documentation on https://docs.splunk.com/Documentation/AddOns/released/MSIIS/Setupaddon says to create inputs.conf on the Universal Forwarder as follows:

[monitor://C:\inetpub\logs\LogFiles]
disabled = false
sourcetype = ms:iis:default

EDIT: I once had some log files missing. Turns out some log files were identical. Splunk will not index identical files to prevent indexing log rotated files.

EDIT: In Splunk search for "index=_* C:\inetpub\logs\LogFiles\W3SVC2\MISSINGFILE". Perhaps the debug logs can give you a useful hint.