MS IIS 2008 app, fields not being parsed with ms:iis:auto

[jennjoe1]

I can write a custom field extractor that works on the search-head but having problems with the auto portion.

Since w3c is variable and can have a user defined list of fields I am trying to get the auto function to work. I think this will read a commant field and use that to define the search time extractions. This is what is written currently in the test environment.

Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status time-taken

Running a search i can see the data is there, but the fields are not indexed properly.

2018-02-15 16:18:59 ::1 GET /welcome.png - 443 - ::1 Mozilla/5.0+(Windows+NT+6.1;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/63.0.3239.132+Safari/537.36 200 0 0 8

The props.conf file I have is the one in default.

I don't want to use a custom field extraction because I know my web developers will change stuff up on me and its not static across multiple iis environments.

What am I missing ?

JMJ

[jennjoe1]

The app is installed on both the head and the forwarder. This is a DEV instance so the indexer and search head are on the same platform.

[micahkemp]

Two more things:

Make sure you've restarted the forwarder

You may need to wait for the log files to rotate to see a new header before the auto sourcetype works.

[micahkemp]

Make sure you've installed the IIS TA on the forwarder (even if it's a universal forwarder) and indexer for ms:iis:auto to work. From the docs:

If you use a universal forwarder for data collection, install the add-on on both your universal forwarder and indexer.
The forwarder needs to be installed directly on the Microsoft IIS server for directory monitoring. As an alternative, the Microsoft IIS log files can be copied or shared to the machine where the forwarder is installed.