Getting Data In

How do you check where an index is being sent to on an IIS Box ?

itrimble1
Path Finder

We have this on /etc/system/local for testing

Inputs.conf file

[default]

host = server name goes here

[monitor://C:\inetpub\logs\LogFiles\W3SVC1]
sourcetype = ms:iis:default
index = ms_iis
Tags (2)
0 Karma

woodcock
Esteemed Legend

Try these:

$SPLUNK_HOME/bin/splunk btool inputs list --debug
$SPLUNK_HOME/bin/splunk btool props list --debug
0 Karma

anthonymelita
Contributor

You have that in the $SPLUNK_HOME/etcsystem/local, but if you chose to index IIS logs during the MSI install process then it will probably be in a different app under $SPLUNK_HOME/etc/apps

0 Karma

lakshman239
SplunkTrust
SplunkTrust

per the above, your sourcetype = ms:iis:default logs goes to index=ms_iis

you can search for index=ms_iss sourcetype=ms* to check all sourcetypes related to IIS logs.

0 Karma

itrimble1
Path Finder

I meant from the IIS Box. Which logs on the IIS box would tell me that it's going to the ms_iis index.

I am trying to troubleshoot, why they keep ending up in the catchall main index.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Run btool on the machine to see what index is actually applied. Other than then, you can look at metrics.log to see which index that sourcetype is going to.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...