Exclude non-standard IIS result codes

[drultima]

I am trying to get a chart of IIS result codes (mapped as sc_status) and ignore crap data. For example, one of the results is "d=b12cLNsVYpmzlry7j5YnBWAea9DqTv7wf4KfnNW5f9uikX1OCcOXHgiGq_gTDdu_Xvuof5kiKu38xBB1vNS7v5kRAsG6Ek5h1XRZs26gkWNCidig5vcOxuVvPxWs3rwqIlHHuo78Yvs6s0jWw9CZ8gAb6HVevXpGJmp6QnvrVCAP50ry0&t=636407345820000000"

Here is my search:

host=HOSTNAMEPATTERNHERE index=RIGHTINDEX sourcetype=iis | chart count by sc_status usenull=false useother=false

I want the actual results to only be known IIS response codes (100-503.2) and ignore everything else (0, random ip address, ridiculous result above, etc.). I have tried a couple of eval statements, but I cannot get them formed correctly.

[poete]

Hello @drultima,

try using rex. For instance:

| makeresults
| eval sc_status="d=b12cLNsVYpmzlry7j5YnBWAea9DqTv7wf4KfnNW5f9uikX1OCcOXHgiGq_gTDdu_Xvuof5kiKu38xBB1vNS7v5kRAsG6Ek5h1XRZs26gkWNCidig5vcOxuVvPxWs3rwqIlHHuo78Yvs6s0jWw9CZ8gAb6HVevXpGJmp6QnvrVCAP50ry0&t=636407345820000000"
| rex field=sc_status "(?^[0-9\.]+)"

will give you a null iis_status, you can then filter out.

For more details about rex, please refer to:
http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Rex

[drultima]

I temporarily got around it by adding in

sc_status>99 AND sc_status<504

But I think there should be a better way to do it than that.