I have set up the Universal Forwarder on a few machines with iis web servers. iis splits the logs into separate folders for the different 'sites' on iis for W3SVC logs. These are numbered sequentially like W3SVC1, W3SVC2, W3SVC3, etc.
My issue is trying to use a combination of wildcards as documented: https://docs.splunk.com/Documentation/Splunk/latest/Data/Specifyinputpathswithwildcards but I am only getting one WSVC log directory getting indexed. I have tried a few formats with wildcards, but for this particular server I am only getting back W3SVC1 and not from W3SVC2, even though there are logs within W3SVC2 that are within my ignoreolderThan timespan (120d).
I have also set up forwarder management, and have included a serverclass. Everything looks OK, but I am not getting the logs from W3SVC2. For example, I have tried:
[default]
host = INS-PURE01-PREP
[monitor://C:\inetpub\logs\LogFiles\W3SVC*\*]
index = weblogs
sourcetype = iis
ignoreOlderThan = 120d
disabled = false
I have also tried
[default] host = INS-PURE01-PREP
[monitor://C:\inetpub\logs\LogFiles\...\*]
index = weblogs sourcetype = iis
ignoreOlderThan = 120d
disabled = false
... and I have also tried
[default]
host = INS-PURE01-PREP
[monitor://C:\inetpub\logs\LogFiles\*]
index = weblogs
sourcetype = iis
ignoreOlderThan = 120d
disabled = false
None of them are getting the W3SVC2 directory pushed/pulled into splunk for indexing. Is this a problem with the Universal Forwarder of Windows? Of course these are all Windows Boxes, including the deployment manager of course. Do I have to explicitly declare a monitor for each of the W3SVC directories? I would like to avoid that as I would like to use the deployment manager model and just have every log in one of the W3SVC# directories within C:\inetpub\logs\LogFiles get indexed by Splunk.
I have read existing posts and searched all over, but I can't see anywhere why this is not working. Thank you.
... View more