Getting Data In

Monitoring a folder that stores my IIS logs, why is a new Source created daily for each new IIS log file?

dglass0215
Path Finder

I have Splunk set to monitor the folder that stores my IIS logs. It is currently working, however, since there is a new log file created daily, each one is considered a source. So when I look at my data summary I have 215 sources and counting since each day a new one is added. Is this the way it is supposed to be?

Tags (3)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi dglass0215,

Yes, this is the way Splunk handles source files; it creates for each new file a field called source=NewFileName. Maybe you mixed it up with sourcetype? This should not be set to auto else it can happen, that Splunk creates new source types as well and this will make your life harder in creating fast performing searches.

Read the docs http://docs.splunk.com/Documentation/Splunk/6.2.2/Data/Whysourcetypesmatter?r=searchtip to get more details on this topic.

cheers, MuS

0 Karma

dglass0215
Path Finder

My sourcetype is correctly set to "iis". I just find it odd that I have a new source added each day. So that means after a year I will have 365 sources from monitoring the log file directory. Just seems silly to me. But thanks for your answer.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...