Splunk Search

How to extract time-taken from IIS logs

New Member

We are trying to build an alert based on the 'time-taken' IIS field;
the query we have is:
sourcetype=iis_logs host="hostname" AND "POST /request/request" | rex "(?w*)$"

the restuls being returned include the entire IIS Log line:

2014-03-23 13:11:12 POST /request/request - 4301 Customer - 200 0 0 951

What we'd like is to have the query returns the results as follows:
Host , Request URL , Time-taken


Tags (1)
0 Karma


Assuming the field names exist like this in your search, you can append this

... | table host request_url time_taken

to get your three-column table.

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...