topic Re: IIS Error 200 monitor in Getting Data In

IIS Error 200 monitor

vaibhavbeohar — Thu, 03 Jan 2013 10:26:44 GMT

Hi,

I have running Splunk with IIS log, in my search i have created field name Error in my log.
we have consider error 200 is ok status, want to remove error 200 in my field(Error), what should i need to give in search, i tried following options.

| fields - Error=200
| fields - "Error=200"
| fields - 'Error=200'
but none of the options are working

Thanks,
Vaibhav.

Re: IIS Error 200 monitor

dart — Thu, 03 Jan 2013 10:44:24 GMT

sourcetype=iis* Error!=200

should give you all those with non 200 error codes. You may wish to use:

sourcetype=iis* Error!=2*

Re: IIS Error 200 monitor

vaibhavbeohar — Thu, 03 Jan 2013 11:11:48 GMT

thanks alot.