Hi,
I have running Splunk with IIS log, in my search i have created field name Error in my log.
we have consider error 200 is ok status, want to remove error 200 in my field(Error), what should i need to give in search, i tried following options.
| fields - Error=200
| fields - "Error=200"
| fields - 'Error=200'
but none of the options are working
Thanks,
Vaibhav.
sourcetype=iis* Error!=200
should give you all those with non 200 error codes. You may wish to use:
sourcetype=iis* Error!=2*
thanks alot.