All Apps and Add-ons

Splunk Add-on for Microsoft IIS compatability with Splunk App for Web Analytics data

nbonner
Explorer

Most of my web data is brought in with the Splunk Add-on for Microsoft IIS using the ms:iis:auto sourcetype. I am attempting to get the Splunk App for Web Analytics to work with this data. So far I have done the following:

  1. updated the apps web eventtype to include the ms:iis:auto sourcetype
  2. Configured a few sites
  3. Ran the lookups (pages gets data but sessions does not)

None of the dashboards of populating as expected. What other steps should I take to allow the Splunk App for Web Analytics to work with the Splunk Add-on for Microsoft IIS?

0 Karma

pscsmoke
Engager

IIS logs by default don't cover all the items needed for this app. If you go into your IIS instance and adjust the fields logged to include:

Fields:

date
time
s-sitename
s-computername
s-ip
cs-method
cs-uri-stem
cs-uri-query
s-port
cs-username
c-ip
cs-version
cs(User-Agent)
cs(Cookie)
cs(Referer)
cs-host
sc-status
sc-substatus
sc-win32-status
sc-bytes
cs-bytes
time-taken

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...