Configure recommended fields in the Splunk Add-on for Microsoft IIS

Splunk recommends you configure these fields for your business needs. There are different configuration instructions for different versions of Microsoft IIS.

For Microsoft IIS versions 8.5 and 10.0

1. Open IIS Manager.
2. On server, site or application level, double click on Logging.
3. Click Select Fields.
4. In W3C Logging Fields window, select all the fields listed under Standard Fields.
5. Next, click "Add Field under "Custom Fields box.
6. In the Add Custom Field window, fill out the following fields and click on OK after adding each fields in top-down order.

   Field Name	Source type	Source
   X-Forwarded-For	Request Header	X-Forwarded-For
   Content-Type	Request Header	Content-Type
   https	Server Variable	HTTPS

7. Click OK in the W3C Logging Fields window.
8. Click Apply in the actions pane.

For Microsoft IIS versions 7, 7.5 and 8.0

1. Open IIS Manager.
2. On server, site or application level, double click Advanced Logging.
3. In the action pane on right side, click Enable Advanced Logging.
4. In the action pane, click Edit Logging Fields.
5. In the new window, click Add Field.
6. In Add Logging Field window, fill out the following fields and click on OK after adding the below fields in top-down order:

   Field Name	Source Type	Source
   X-Forwarded-For	Request Header	X-Forwarded-For
   Content-Type	Request Header	Content-Type
   https	Server Variable	HTTPS

7. In the middle pane, select the default log definition %COMPUTERNAME%-Server. Click Edit Log Definition.
8. Click Select Logging Fields.
9. Select X-Forwarded-For, Content-Type and https from the list. Click OK.
10. Click Apply in the actions pane.