I have a number of IIS logs being splunked across a number of servers but an struggling to work out how to present the information usefully. I have 4 web servers, each have 5 web sites - each web site is a different sourcetype - IIS(iis_type). I am extracting the following information from each web site: method status responsetime source_ip I really want to be able to show what is going on in each website in terms of status and responsetimes and what source_ip the failures / slow responses are coming from. I can create very basic specific searches but am struggling to present the information in a broader more intelligent way. ideally, I'd like to run a report or series of reports each day showing usage and notably failures. any suggestions? ... View more

Field extraction appears to be restricted to Host, Source or sourcetype - I have multiple web servers, and even web services running on the same server - but they all generate different sourcetypes. Currently I create a Field Extraction per source, but want to know if I can make this more generic and use it across any IIS log. All the logs are given different sourcetype names, to differentiate at search level. has anyone used the Splunk app for web Intelligence? would this assist? ... View more

sure this is very similar to other questions but I have not been able to apply any of the suggestions successfully. Search as follows: sourcetype="adloader" | stats min(_time) AS earliest max(_time) AS latest by TransactionID | eval duration=latest-earliest | fields - latest output TransactionID - earliest - duration 21354ewer12 - 1330088785.771 - 1.954 how can I convert the earliest column to proper date/time format. ... View more

iam trying to extarct the room name fromt eh string below but the automatioc filed extraction does not fined enough examples due to numerous other messages in logs. "chat://room/domain/roomname" I created a filed extraction to extract the domain, called domain but am not able to get splunk to extract the room name. need to extract all characters between the last / and the ". appreciate your help ... View more

Installed Splunk on Splunk 2.1 on 4.2.1 but when opening app and app is retrieving information about splunk server in a glimpse of your server, it returns "The lookup table 'splunk_instances_info' is invalid" in pop up bar on menu and no fields are populated in a glimpse of your server frame. Sideview utils 1.2.5 is installed. have not found any otehr issues with splunk server ... View more