The venerable old-skool Splunk forums are now closed. Feel free to search for old content here, but new posts are no longer supported.

Instead, please visit the thriving community at answers.splunk.com to ask and answer questions about your Splunk deployment and how to get the most out of it.

Forums: SplunkGeneral: Mysterious IIS-2 sourcetype

Previous Topic: Linux on PPC  |   Next Topic: Deleted Events -- syslog


Posts 1–6 of 6
1
posted by: msallman  |  posts
date: February 24, 2010
permalink

Since upgrading to 4.0.9, Splunk seems to have decided that I need an IIS-2 sourcetype (created in /etc/apps/learned/local/props.conf as best I can tell).
Is there a way to get rid of this? I tried deleting the stanza from props.conf (and an apparently associated one in transforms.conf), but Splunk keeps re-creating it/them.
I already have an IIS sourcetype, so when Splunk decides to use IIS-2 instead, it messes up my searches/reports.

Thanks

2
posted by: araitz  |  posts
date: February 24, 2010
permalink

Agree, there are some opportunities for improvement with the automatic sourcetyper. The best practice is to manually set the sourcetype in inputs.conf whenever possible.

3
posted by: msallman  |  posts
date: February 25, 2010
permalink

I do have it in inputs.conf:

[monitor://\\iis_server\LogFiles\W3SVC1]
disabled = 0
host = iis_server
sourcetype = IIS

And it worked fine until 4.0.9.

4
posted by: bnwri  |  posts
date: March 16, 2010
permalink

I've got the same problem. Even specifying the sourcetype in inputs.conf doesn't have an effect. As it is I'm working on using the "rename = iis" key/value pair in my props.conf to manually rename the sourcetype, but it would sure be nice if this worked out of the box.

5
posted by: danieljimenez  |  posts
date: April 6, 2010
permalink

Seeing the same issue here. Any way to change the sourcetype of existing data?

6
posted by: choneycutt  |  posts
date: September 10, 2010
permalink

Had similar experience. I initially set the sourcetype to automatic for my inputs. The data was then indexed and I ended up with sourcetype iis-2, iis-3.

So I then modified the inputs.conf file to manually set the sourcetype to iis. But my indexed data remained with iis-2 and iis-3.

According to the manual, changing sourcetype affects new data coming in after the config change, and not the indexed data.

So i then modified props.conf to rename the sourcetype for the already indexed data.

[iis-2]
rename = iis

Below is where I found it in the documentation:

Override automatic source type:
http://www.splunk.com/base/Documentation/latest/Admin/Bypassautomaticsourcetypeassignment

Renaming Source type:
http://www.splunk.com/base/Documentation/latest/Admin/Renamesourcetypes