topic Re: How do I extract farm name from IIS logs to a table? in Splunk Search

How do I extract farm name from IIS logs to a table?

smudge797 — Fri, 14 Sep 2018 12:55:04 GMT

I'm Trying to run a table on IIS logs. The farm is https://sp001, examples below)... However, within the farm we have individual sites. I would like to be able to extract the site name, like "Access%20Requests KYCOpsSupportDocuments" etc... , to table:

https://sp004.mydomain.net/sites1/spvfvfst/Access%20Requests/pendingreq.aspx...
https://sp004.mydomain.net/sites1/spvfvfst/KYCOpsSupportDocuments/...
https://sp004.mydomain.net/sites1/spvfvfst/KYCOpsSupportDocuments/...
https://sp004.mydomain.net/sites1/spvfvfst/Blah/LOB%20Es...
https://sp004.mydomain.net/sites1/spvfvfst/_vti_bin/LOB%20Escalation..
https://sp004.mydomain.net/sites1/spvfvfst/12345dddd/LOB%20Escalation3bivey%25252C%252520Sara&ContentTypeId=0x010047A299BD56B33B42903EAD238B543EC1&RootFolder=%2Fsites1%2Fspvfvfst%2FLists%2FL...
https://sp004.mydomain.net/sites1/spvfvfst/Lists/LOB%20Escalation8B...

Thanks!

Re: How do I extract farm name from IIS logs to a table?

493669 — Fri, 14 Sep 2018 13:16:56 GMT

@smudge797, Try this:

...|rex field=<fieldname> "https:\/\/([^\/]+\/){3}(?<sites>[^\/]+)"

try this run anywhere search-

| makeresults |eval a="https://sp004.mydomain.net/sites1/spvfvfst/Access%20Requests/pendingreq.aspx..."|rex field=a "https:\/\/([^\/]+\/){3}(?<sites>[^\/]+)"

Re: How do I extract farm name from IIS logs to a table?

harishalipaka — Fri, 14 Sep 2018 13:18:26 GMT

hi @smudge797

try this query

 | rex field=<fieldname> "/spvfvfst/(?<MyField>[^,\s]+)/"

Re: How do I extract farm name from IIS logs to a table?

imthesplunker — Sun, 16 Sep 2018 03:33:40 GMT

Hi @smudge797, Try this

your base search | rex field=_raw max_match=0 "spvfvfst\/(?<site_name>\S+)\/"