How to filter IIS logs with regular expression?

[markuxProof]

Greetings,

I'm trying to make a regular expression to filter the IIS logs.
I want Splunk to index only logs whose sc-status field> = 500, but I'm not able to implement.

Can someone help me?

[markuxProof · Accepted solution]

Guys, I think I already have it. I did the reverse. I have selected for exclusion records < 500

[markuxProof]

Thanks @ Woodcock. That's what I needed.

[markuxProof]

For those with the same doubt, I did a regex that corresponds to http <500 status in IIS Logs:
([1-4]\d+|\b0\b)

[woodcock]

Yes, you NullQueue the ones to drop with props.conf and transforms.conf.

[aaraneta_splunk]

@markuxProof - Was the above the solution to your question? Or were you just providing more context? If it's the former, let me know so I can convert it and accept it as an answer.

[markuxProof]

yes aaraneta, tks.