Reporting

extracting time-taken field from IIS logs

ebailey
Communicator

We need to start alerting on the results of the IIS time taken field. Any idea how to extract that field so it can be easily searched? I am hasving no luck at all.

example output

2012-04-25 21:23:31 ::1 POST /PU.PDS.ExternalServices/SolutionExecution/ExternalSolutionExecution.svc - 80 - ::1 - 200 0 0 11734

I need to sertup an alert on the last field output "11734" when it gets over 10000.

Thanks!

Ed

0 Karma

roumys
Explorer

Try to see if adding this in your search works.

sourcetype=iis_logs| rex "(?\w*)$"

See if the field time_taken is matching the last digits correctly. Then create an alert and make it alert if time_taken > 10000

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...