Getting Data In

Multiple File Locations to Single Sourcetype

ltrand
Contributor

I currently have two methods of collecting IIS logs, Syslog & UF. As IIS can have multiple log locations depending on version, we have specified many different locations for the inputs.conf and are trying to point all sources at a single sourcetype & index, IIS. Unfortunately Splunk is giving us IIS, IIS-2, and IIS-####. We can't seem to locate the configuration item that is splitting this out.

For syslog I have syslog-ng parsing the incoming data and dumping it to a file on a forwarder to which splunk then picks up and indexes. This is used extensively and works flawlessly with other data, however for IIS logs, syslog is giving these the autonaming of IIS-# (mostly IIS-2, but not all). We have a single configuration stanza for this that specifies %SyslogHome/IIS/%HostIP/%Date.log as the source.

For UF we are using inputs.conf to define the IIS log locations and assign them as ISS. Two examples:

[monitor://C:\windows\system32\LogFiles\W3SVC1*.log]
disabled = 0
sourcetype = iis
index = idx_iis

[monitor://C:\inetpub\logs\LogFiles\W3SVC1*.log]
disabled = 0
sourcetype = iis
index = idx_iis

So the question; why, and via what configuration, is Splunk renaming some of the logs? We are seeing sources and hosts in sourcetype=IIS. We even have hosts logging into sourcetype=IIS as well as IIS-#.

Thanks!

0 Karma
1 Solution

bshuler_splunk
Splunk Employee
Splunk Employee

Specifically, in the version of splunk you are using, iis a learned source type. Because the iis admin can change the log file format at will, splunk looks at the file header, records what it sees, and records the source type as iis-1. Once you change the fields, you get iis-2. If you change it back, you get iis-1 again.

The details of the fix are here: http://blogs.splunk.com/2013/10/18/iis-logs-and-splunk-6/

View solution in original post

bshuler_splunk
Splunk Employee
Splunk Employee

Specifically, in the version of splunk you are using, iis a learned source type. Because the iis admin can change the log file format at will, splunk looks at the file header, records what it sees, and records the source type as iis-1. Once you change the fields, you get iis-2. If you change it back, you get iis-1 again.

The details of the fix are here: http://blogs.splunk.com/2013/10/18/iis-logs-and-splunk-6/

bshuler_splunk
Splunk Employee
Splunk Employee

Upgrade, that has been fixed in the latest version.

0 Karma

ltrand
Contributor

Thanks bshuler,

I was wondering if you could elaborate on the root cause of the issue? We're still a bit aways from being ready to upgrade and would like to hand-jam a solution if there is one.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...