Getting Data In

IIS Error 200 monitor

vaibhavbeohar
Path Finder

Hi,

I have running Splunk with IIS log, in my search i have created field name Error in my log.
we have consider error 200 is ok status, want to remove error 200 in my field(Error), what should i need to give in search, i tried following options.

| fields - Error=200
| fields - "Error=200"
| fields - 'Error=200'
but none of the options are working

Thanks,
Vaibhav.

Tags (1)
0 Karma

dart
Splunk Employee
Splunk Employee
sourcetype=iis* Error!=200

should give you all those with non 200 error codes. You may wish to use:

sourcetype=iis* Error!=2*

vaibhavbeohar
Path Finder

thanks alot.

0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...