Splunk Search

How to filter IIS logs with regular expression?

markuxProof
Path Finder

Greetings,

I'm trying to make a regular expression to filter the IIS logs.
I want Splunk to index only logs whose sc-status field> = 500, but I'm not able to implement.

Can someone help me?

0 Karma
1 Solution

markuxProof
Path Finder

Guys, I think I already have it. I did the reverse. I have selected for exclusion records < 500

View solution in original post

0 Karma

markuxProof
Path Finder

Guys, I think I already have it. I did the reverse. I have selected for exclusion records < 500

0 Karma

markuxProof
Path Finder

Thanks @ Woodcock. That's what I needed.

0 Karma

markuxProof
Path Finder

For those with the same doubt, I did a regex that corresponds to http <500 status in IIS Logs:
([1-4]\d+|\b0\b)

woodcock
Esteemed Legend

Yes, you NullQueue the ones to drop with props.conf and transforms.conf.

aaraneta_splunk
Splunk Employee
Splunk Employee

@markuxProof - Was the above the solution to your question? Or were you just providing more context? If it's the former, let me know so I can convert it and accept it as an answer.

markuxProof
Path Finder

yes aaraneta, tks.

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...