Use Regex to extract time-take field from IIS logs

hagjos43 — Wed, 09 Apr 2014 16:58:04 GMT

I'm a noob to regex. I'm trying to extract the time-taken field from our IIS logs (this is the very last entry in the IIS log) Below is a sample of an entry in our IIS logs:

2014-04-09 12:33:43 W3SVC212014703889 HostName-GoesHere 192.168.1.1 POST /NET/forms/action.cfm - 80 - 10.10.10.10 HTTP/1.1 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.4506.2152;+.NET+CLR+3.5.30729;+.NET4.0C;+.NET4.0E) __utma=0160643.09453435.371030337.371123455.371206007.3;+CFID=0934024;+CFTOKEN=4326922;+LastMRH_Session=f343018;+F5_ST=1,1,1,397046727,04800;+JSESSIONID=430d83085f0220a92cb5b1184b305a2d501;+TS8ada1b=5a642dc1bf90ac67c6b2aa83fa05b09abbd49a527d4ef10353453dc660ac0ec5504bf0e2 https://www.stuff.com/NET/forms/action.cfm www.stuff.com 302 0 0 426 1197 31

The value I want to extract to a field called "time-taken" is the number 31 above, the very last entry in the log file. And for IIS logging purposes there is always a space before it, and it is always the last entry in the log.

Many thanks!

Re: Use Regex to extract time-take field from IIS logs

lukejadamec — Wed, 09 Apr 2014 17:03:04 GMT

Try:
your search |rex ".*\s(?P<TimeTaken>\d+)$" |table TimeTaken

Re: Use Regex to extract time-take field from IIS logs

lukejadamec — Wed, 09 Apr 2014 17:04:26 GMT

You can also use the automated field extracter for this.

Re: Use Regex to extract time-take field from IIS logs

hagjos43 — Wed, 09 Apr 2014 17:06:29 GMT

PERFECT! THANK YOU!

topic Re: Use Regex to extract time-take field from IIS logs in Splunk Search

Use Regex to extract time-take field from IIS logs

Re: Use Regex to extract time-take field from IIS logs

Re: Use Regex to extract time-take field from IIS logs

Re: Use Regex to extract time-take field from IIS logs