Hello,
We have iis log being stored in a S3 bucket in CSV format. My understanding is sourcetype for CSV will help parsing these events and indexing them as they come in. I would like to use our aws-add-on which includes a generic s3 input to pick up these logs and parse it with either my custom sourcetype or iis sourcetype...
First of all, Is this possible?
I have tried to create this via Splunk add-on for aws -> Input -> Create New Input -> Custom Data Type -> Generic S3 . the sourcetype drop down only has aws specific sourcetype, I could type any sourcetype name and add the input, however when i searched for these events, the events are not parsed and displayed as raw only.
I have also tried using IIS Add-on which come with a sourcetype for iis logs but that didnt work.
Please let me know if you have done it before and got it to work.
Kind regards,
Sam
Note: Because we are using splunkcloud , unfortunately we can't edit the actual config files as it is not managed by us 😞 Please let me know if there is a documentation or if you know how to achieve this in the UI, that would be great.
Cheers