How to extract time-taken from IIS logs

yennaciri — Mon, 28 Sep 2020 16:12:43 GMT

We are trying to build an alert based on the 'time-taken' IIS field;
the query we have is:
sourcetype=iis_logs host="hostname" AND "POST /request/request" | rex "(?w*)$"

the restuls being returned include the entire IIS Log line:

2014-03-23 13:11:12 10.250.80.250 POST /request/request - 4301 Customer 10.250.80.11 - 200 0 0 951

What we'd like is to have the query returns the results as follows:
Host , Request URL , Time-taken

Thanks

Re: How to extract time-taken from IIS logs

martin_mueller — Sun, 23 Mar 2014 15:39:02 GMT

Assuming the field names exist like this in your search, you can append this

... | table host request_url time_taken

to get your three-column table.

topic How to extract time-taken from IIS logs in Splunk Search

How to extract time-taken from IIS logs

Re: How to extract time-taken from IIS logs