Splunk Search

How can I split IIS logs from Amazon Kinesis stream on "- -" ?

jmajumdar
Explorer

Hello -

Is there a way to split the line below : with '--". This is from the IIS logs of Amazom Kinesis. 200 is http status code. Sometimes it is a different status code, such as 500 or 404 etc. I noticed they always have "--" in front of it (unlike windows iis log or Apache) . So if I can split it at "--" , I can use the rex field to do the rest . Whenever I try the below , it does not work . Has anyone every had to deal iis log from aws kinesis stream?
eval temp=split(logmessage,"- -") | eval FieldB=mvindex(temp,1) .

This is the line:
"111.111.111.111 GET /somethingFinder.Services/6/healthcheck - 80 - 111.11.111.111 - - 200 0 0 2"

0 Karma

saurabhkharkar
Path Finder

If you just want to split at '- -' by adding a line break you can use this

| makeresults
| eval _raw="111.111.111.111 GET /somethingFinder.Services/6/healthcheck - 80 - 111.11.111.111 - - 200 0 0 2"
| rex mode=sed field=_raw "s/- -/\n/g"

or if you want the status code extracted - use this
| makeresults
| eval _raw="111.111.111.111 GET /somethingFinder.Services/6/healthcheck - 80 - 111.11.111.111 - - 200 0 0 2"
| rex field=_raw ".*?- -\s(?\d+)"
| table _raw change

0 Karma

saurabhkharkar
Path Finder

after ? add <_raw>
| table _raw

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...