IIS Error 200 monitor

[vaibhavbeohar]

Hi,

I have running Splunk with IIS log, in my search i have created field name Error in my log.
we have consider error 200 is ok status, want to remove error 200 in my field(Error), what should i need to give in search, i tried following options.

| fields - Error=200
| fields - "Error=200"
| fields - 'Error=200'
but none of the options are working

Thanks,
Vaibhav.

[dart]

sourcetype=iis* Error!=200

should give you all those with non 200 error codes. You may wish to use:

sourcetype=iis* Error!=2*

[vaibhavbeohar]

thanks alot.