I'm trying to make a regular expression to filter the IIS logs.
I want Splunk to index only logs whose sc-status field> = 500, but I'm not able to implement.
Can someone help me?
Guys, I think I already have it. I did the reverse. I have selected for exclusion records < 500
View solution in original post
Thanks @ Woodcock. That's what I needed.
For those with the same doubt, I did a regex that corresponds to http <500 status in IIS Logs:
Yes, you NullQueue the ones to drop with props.conf and transforms.conf.
@markuxProof - Was the above the solution to your question? Or were you just providing more context? If it's the former, let me know so I can convert it and accept it as an answer.
yes aaraneta, tks.