https://community.splunk.com/t5/Splunk-Search/How-to-filter-IIS-logs-with-regular-expression/m-p/310309#M93077 <P>@markuxProof - Was the above the solution to your question? Or were you just providing more context? If it's the former, let me know so I can convert it and accept it as an answer.</P> Fri, 17 Feb 2017 23:33:22 GMT aaraneta_splunk 2017-02-17T23:33:22Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-IIS-logs-with-regular-expression/m-p/310307#M93075 <P>Greetings,</P> <P>I'm trying to make a regular expression to filter the IIS logs.<BR /> I want Splunk to index only logs whose sc-status field&gt; = 500, but I'm not able to implement.</P> <P>Can someone help me?</P> Fri, 17 Feb 2017 18:45:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-IIS-logs-with-regular-expression/m-p/310307#M93075 markuxProof 2017-02-17T18:45:16Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-IIS-logs-with-regular-expression/m-p/310308#M93076 <P>Guys, I think I already have it. I did the reverse. I have selected for exclusion records &lt; 500</P> Fri, 17 Feb 2017 18:54:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-IIS-logs-with-regular-expression/m-p/310308#M93076 markuxProof 2017-02-17T18:54:36Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-IIS-logs-with-regular-expression/m-p/310309#M93077 <P>@markuxProof - Was the above the solution to your question? Or were you just providing more context? If it's the former, let me know so I can convert it and accept it as an answer.</P> Fri, 17 Feb 2017 23:33:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-IIS-logs-with-regular-expression/m-p/310309#M93077 aaraneta_splunk 2017-02-17T23:33:22Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-IIS-logs-with-regular-expression/m-p/310310#M93078 <P>Yes, you <CODE>NullQueue</CODE> the ones to drop with props.conf and transforms.conf.</P> Sat, 18 Feb 2017 22:53:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-IIS-logs-with-regular-expression/m-p/310310#M93078 woodcock 2017-02-18T22:53:06Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-IIS-logs-with-regular-expression/m-p/310311#M93079 <P>yes aaraneta, tks.</P> Mon, 20 Feb 2017 12:44:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-IIS-logs-with-regular-expression/m-p/310311#M93079 markuxProof 2017-02-20T12:44:45Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-IIS-logs-with-regular-expression/m-p/310312#M93080 <P>Thanks @ Woodcock. That's what I needed.</P> Mon, 20 Feb 2017 13:15:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-IIS-logs-with-regular-expression/m-p/310312#M93080 markuxProof 2017-02-20T13:15:10Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-IIS-logs-with-regular-expression/m-p/310313#M93081 <P>For those with the same doubt, I did a regex that corresponds to http &lt;500 status in IIS Logs:<BR /> ([1-4]\d+|\b0\b)</P> Wed, 22 Feb 2017 17:55:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-IIS-logs-with-regular-expression/m-p/310313#M93081 markuxProof 2017-02-22T17:55:43Z