I have not yet started ingesting IIS logs from my systems. The systems have roughly 2 years of logs stored on them, that I need to ingest for IA compliance reasons. I'm going to utilize ignoreOlderThan = 0 setting to ingest all of the logs that are stored on the system. My situation is complicated by the fact that all systems in our environment are clones, so some of the logs that are present on the systems are valid, and some of the logs that are present are remnants from the system that it was cloned from. I became aware of this when I was testing and a co-worker pointed out that Splunk had logs for my test system going back 4 months, but the system was just cloned 2 weeks ago. For example, the following 2 logs came from the same system, which is currently named ZA70027. 2015-03-10 13:24:08 W3SVC2 ZA70043 10.1.101.116 GET /XenApp/loading.htm - 443 - 204.223.38.5 Mozilla/5.0+(compatible;+MSIE+10.0;+Windows+NT+6.1;+WOW64;+Trident/6.0) <Address Removed> 200 0 0 1957 345 1872 2015-06-15 18:32:22 W3SVC2 ZA70027 10.1.101.124 GET /XenApp/media/LoginPaneFooterMidBorderGlow.png - 443 <Account Removed> 192.156.37.34 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+6.1;+WOW64;+Trident/7.0;+SLCC2;+.NET+CLR+2.0.50727;+.NET+CLR+3.5.30729;+.NET+CLR+3.0.30729;+Media+Center+PC+6.0;+InfoPath.3;+.NET4.0C;+.NET4.0E) <Address Removed> 200 0 0 549 600 46 I am already running all my logs through heavy forwarder. I would like to utilize a Regex search string in my transforms to drop unwanted logs. Is there a way to verify that the current system's hostname exist in the IIS log before sending them to the indexer? ... View more

I am running version 6.3.0 on my indexer and all my universal forwarders. I'm currently trying to get things configured properly on one of my iis servers before pushing this configuration out to all of my other iis servers. The iis logs are being forwarded to my index, but the only fields that are being extracted are host , source and sourcetype . The inputs.conf on my iis server contains: [monitor://<log_location>] sourcetype = iis index = iis_logs The props.conf on my iis server contains: [iis] INDEXED_EXTRACTIONS = w3c My indexer contains the default props.conf which includes [iis] pulldown_type = true MAX_TIMESTAMP_LOOKAHEAD = 32 SHOULD_LINEMERGE = false INDEXED_EXTRACTIONS = w3c detect_trailing_nulls = auto category = web description = w3c Extended log format produced by the Microsoft Internet Information Services (IIS) web server Am I missing something that is preventing my indexer from extracting the fields from the iis logs? ... View more

I just set up my first Splunk Deployment server. I'm trying to get used to how it works, and how to manage it. In an attempt to K.I.S.S. I decided that my first app that I would deploy and manage would be the the "Windows Universal Forwarder" AKA "Splunk_TA_Windows". After deploying the app from my deployment server to my clients, I attempted to modify the inputs.conf on the deployment server with the expectation that the change would propagate down to all the clients. Unfortunately that did not happen. After successfully deploying the app to the six clients in my "Test" server class, the updated inputs.conf did not propagate down to the six clients. After editing the .\etc\Splunk_TA_Windows\local\inputs.conf I believe I reloaded the deployment server properly with the following command: .\bin\splunk reload deploy-server . Now my clients are all showing the same entries in the splunkd.log Successful App deployment: 10-21-2015 12:34:29.626 -0500 INFO DeployedApplication - Installing app=Splunk_TA_windows to='D:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows' Failed App update: 10-21-2015 12:41:51.332 -0500 INFO DeployedApplication - Checksum mismatch 0 <> 1316440081260235894 for app=Splunk_TA_windows. Will reload from=' :8090/services/streams/deployment?name=default:Test%203:Splunk_TA_windows' 10-21-2015 12:41:51.752 -0500 INFO DeployedApplication - Downloaded url= :8090/services/streams/deployment?name=default:Test%203:Splunk_TA_windows to file='D:\Program Files\SplunkUniversalForwarder\var\run\Test 3\Splunk_TA_windows-1445449223.bundle' sizeKB=3500 10-21-2015 12:41:52.591 -0500 WARN DeployedApplication - app=Splunk_TA_windows, installed_via="search head cluster deployer, UI, CLI, or REST API", checksum=0a01c29a8ea0ff2831f002c02fe365f9210ad2d7 10-21-2015 12:41:52.591 -0500 WARN DeployedApplication - app=Splunk_TA_windows was already installed via search head cluster deployer, UI, CLI, or REST API; it may not be overridden via deployment server; remove existing app=Splunk_TA_windows via search head cluster deployer, UI, CLI, or REST API if you wish to install it via deployment server 10-21-2015 12:41:52.591 -0500 ERROR DeployedServerclass - name=Test 3 Failed to install app=Splunk_TA_windows To troubleshoot this I've: - Restarted the SplunkUniversalForwarder service on the affected client. No change. - Restarted the Deployment server. Its a Windows VM, so that should have been trouble shooting step number 1. No change. - Manually removed the app folder from the client, and then restarted the SplunkUniversalForwarder service. After doing this the App will deploy successfully, but the problem reoccurs if I try to edit the inputs.conf file What am I missing? What did I do wrong when I set up my deployment server? Thanks for the help! Ken ... View more

I spent hours trying to figure this out Friday, and it's been bugging me all weekend. So, I'm hoping the community can help me figure this out! The info below is all from memory, hopefully I don't miss anything. First off, I'm completely new to Splunk... So if I butcher terminology or concepts, please understand! I am now trying to come in and fix something that appears to have never worked. Several months ago, the Splunk universal forwarder was pushed out to all of my Windows machines. I am fairly certain that it was pushed out using our patching solution "BigFix". Fast forward to today. I am receiving data from about 150 hosts. Unfortunately, I should be receiving data from closer to 350. My domain controllers are included in the list of the systems that are not forwarding data. The guy before me decided to set up a heavy forwarder, something about blowing through our license. I haven't looked into the heavy forwarder too much, but I'm assuming that it's working since half of the hosts are getting through to the indexer. 1 - So far I've compared the local/inputs.conf and the local/server.conf on the working system and the not-working system. According to the guy who did the install, those are the only files that he touched after the install. On each of the systems both the local/inputs.conf and the local/server.conf files are basically identical. 2 - Also, on the not-working system and the heavy forwarder I've run NETSTAT -an to verify that the 2 systems are establishing a connection between each other. 3 - I've dug through the var/logs/splunkd.log on both the working and the non-working system, and I didn't see anything obvious that would indicate what is wrong on the non-working system. 4 - I've spent hours making changes to the inputs.conf and the server.conf, then restarting the Splunk forwarder service, to no avail. Where else can I look...What else can I do... to try and figure out why only half of my systems are able to forward events to the indexer, and the other half cannot? Any and all help would be greatly appreciated. Thanks! ... View more