The <from-entity> specified in
queries using the IIS input format is a comma-separated list of:
Paths of Microsoft IIS Log File Format log files;
IIS Virtual Site "identifiers".
"Site identifiers" must be enclosed within angle brackets (< and
>), and can have one of the following values:
The numeric site ID (e.g. "<1>",
"<28163489>");
The text value of the "ServerComment" property of the site
(e.g. "<My External Site>",
"<www.margiestravel.com>");
The fully-qualified ADSI metabase path to the site (e.g.
"<//MYSERVER/W3SVC/1>"), using either the numeric site ID or
the text value of the "ServerComment" property of the site.
When a "site identifier" is used, the IIS input format connects to
the specified machine's metabase, gathers information on the site's
current logging properties, and parses all the log files in the
site's current log file directory.
Filenames and "Site identifiers" can also include wildcards (e.g.
"LogFiles\in04*.log", "<www.*.com>").
Examples:
FROM LogFiles\in04*log, LogFiles\in03*.log, \\MyServer\LoggingShare\W3SVC2\in04*.log
FROM <1>, <2>, <My External Site>, inetsv9.log
FROM <www.net*home.com>, <//MyServer2/W3SVC/www.net*home.com>, <//MyServer2/MSFTPSVC/*>, <*>