hey! i indexed the iis logs. when i type in the search field sourcetype=iis, i see a lot of information in text form. the goal is that i can create a chart with the data volumes of iis for example. another example is, that i can see in a chart, which error appears frequently.
thanks in advance!
sample log:
2014-04-19 11:18:03 ::1 GET /runTests.php - 80 - ::1 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+6.1;+WOW64;+Trident/4.0;+SLCC2;+.NET+CLR+2.0.50727;+.NET4.0C;+.NET4.0E) 200 0 0 6421
2014-04-19 11:18:03 ::1 GET /plugins/gui.ajax/res/js/lib/prototype/prototype.js - 80 - ::1 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+6.1;+WOW64;+Trident/4.0;+SLCC2;+.NET+CLR+2.0.50727;+.NET4.0C;+.NET4.0E) 304 0 64 125
output:
i installed an online data manager on my server. it's called pydio. i want to know, how much upload the users in the last days. is it possible?
If you can provide some sample logs and expected output, we can help you write required search query.
You can try: sourcetype=iis errors | stats count by host | sort -count
You should start with Splunk documentation to learn how to visualize.
http://docs.splunk.com/Documentation/Splunk/6.0.3/Search/Whatsinthismanual
Some quick cheatsheets are available here
http://docs.splunk.com/images/a/a3/Splunk_4.x_cheatsheet.pdf