I agree with what @chrisyoungerjds said. Also, you should be able to do the filtering that you need inside IIS because it has extensive logging configuration features. In fact, that is why INDEXED_EXTRACTIONS was created (which is definitely the way that you should handle IIS) because your IIS admin could change the names/orders of the fields at any time. The whole explanation on your options can be found here:
https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad
... View more