Splunk Search

How do I extract farm name from IIS logs to a table?

Path Finder
0 Karma

Path Finder

Hi @smudge797, Try this

your base search | rex field=_raw max_match=0 "spvfvfst\/(?<site_name>\S+)\/"
0 Karma


hi @smudge797

try this query

 | rex field=<fieldname> "/spvfvfst/(?<MyField>[^,\s]+)/"
0 Karma

Super Champion

@smudge797, Try this:

...|rex field=<fieldname> "https:\/\/([^\/]+\/){3}(?<sites>[^\/]+)"

try this run anywhere search-

| makeresults |eval a="https://sp004.mydomain.net/sites1/spvfvfst/Access%20Requests/pendingreq.aspx..."|rex field=a "https:\/\/([^\/]+\/){3}(?<sites>[^\/]+)"
0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...