I'm new to Splunk
I have a trivial task of analyzing ISS logs.
So I
- installed Splunk on local computer.
- installed "Splunk Add-on for Microsoft IIS"
- Created data source from folder, using ms:iis:auto as source type and Splunk_TA_microsoft-iis.
When I do search after the source was created it displays no IIS log fields, but some internal ones only.
I can not understand from documentation what should I do to see IIS fields in IIS log files.
I tried all combinations, like default application, source type iis or ms:iis:default - same outcome.
Please help.
... View more