Splunk Search

How to filter IIS logs with regular expression?

markuxProof
Path Finder

Greetings,

I'm trying to make a regular expression to filter the IIS logs.
I want Splunk to index only logs whose sc-status field> = 500, but I'm not able to implement.

Can someone help me?

0 Karma
1 Solution

markuxProof
Path Finder

Guys, I think I already have it. I did the reverse. I have selected for exclusion records < 500

View solution in original post

0 Karma

markuxProof
Path Finder

Guys, I think I already have it. I did the reverse. I have selected for exclusion records < 500

0 Karma

markuxProof
Path Finder

Thanks @ Woodcock. That's what I needed.

0 Karma

markuxProof
Path Finder

For those with the same doubt, I did a regex that corresponds to http <500 status in IIS Logs:
([1-4]\d+|\b0\b)

woodcock
Esteemed Legend

Yes, you NullQueue the ones to drop with props.conf and transforms.conf.

aaraneta_splunk
Splunk Employee
Splunk Employee

@markuxProof - Was the above the solution to your question? Or were you just providing more context? If it's the former, let me know so I can convert it and accept it as an answer.

markuxProof
Path Finder

yes aaraneta, tks.

0 Karma
Get Updates on the Splunk Community!

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...