Hi,
I have configured IIS monitoring and am seeing log data from the Microsoft IIS W3C v8.5 tool such as page requests, CSS requests etc. The IIS server has been configured to enable all log entities.
The website log data is being received for has Windows Authentication enabled and I have confirmed with a manual review of the IIS log file that the CS-Username field is being populated in the log. However this data is not being shown in the LEM normalized data structure and I would have expected it to appear in the SourceAccount field.
Is the username value something that LEM should be parsing into it's dataset from the IIS log source and if so how can I get this to appear?
thanks
Mark