Hello,
We have iis log being stored in a S3 bucket in CSV format. My understanding is sourcetype for CSV will help parsing these events and indexing them as they come in. I would like to use our aws-add-on which includes a generic s3 input to pick up these logs and parse it with either my custom sourcetype or iis sourcetype...
First of all, Is this possible?
I have tried to create this via Splunk add-on for aws -> Input -> Create New Input -> Custom Data Type -> Generic S3 . the sourcetype drop down only has aws specific sourcetype, I could type any sourcetype name and add the input, however when i searched for these events, the events are not parsed and displayed as raw only.
I have also tried using IIS Add-on which come with a sourcetype for iis logs but that didnt work.
Please let me know if you have done it before and got it to work.
Kind regards,
Sam
... View more