Splunk Add-on for Microsoft IIS: Tagging and Filtering

[jmut]

Hi,

The Splunk_TA_microsoft_iis add-on deploys eventtypes.conf and tags.conf that should "tag" the events with "web", "Inventory" and "Activity" tags. inputs.conf sets my sourcetype=ms:iis:auto, eventtypes.conf defines a "microsoft_iis_web" eventtype for all events where sourcetypes=ms:iis:*, tags.conf then sets the tags for all events with eventtype=microsoft_iis_web.
This should work but doesn't. Any clues anyone ? When is the tagging done ? on the universal forwarder ? on the indexer ? on the SH ?

Trying to throw away the Response Code 200 events using props.conf and transforms.conf. props.conf defines a TRANSFORMS stanza for sourcetype [ms:iis:auto] to execute "drop200", drop200 is defined in transforms.conf and sets the source_key=field:sc_status before applying Regex=200 and routing to nullQueue. Yet all events are indexed, 200's and all, as if the transformation was not there. Any clues anyone ?

TIA, Johan

[jmut]

First part of the puzzle is solved. Tags are now assigned correctly. Installing the add-on on the indexer layer and the search head took care of this. My bad for only installing the add-on on the Universal Forwarder layer.

Filtering is still not working though, props and transforms look OK, sourcetype is correctly selected, transformation is correctly defined, seems like the regular expression is not matching the event data. REGEX=200 should match any event with 200 in its data or ?