MS SQL ErrorLog have a single line with the following format "Date Time Error: ####, Severity: ##, State: #"
I require a search to find any error with the Severity: grater than 16.
Examples which should come back:
2012-12-03 19:00:30.86 spid29s Error: 1474, Severity: 16, State: 1.
2012-12-03 19:00:30.86 spid29s Error: 1474, Severity: 18, State: 1.
2012-12-03 19:00:30.86 spid29s Error: 1474, Severity: 24, State: 1.
Examples to be ignored:
2012-12-03 19:00:32.72 Logon Error: 18456, Severity: 14, State: 38.
I'm new to splunk searches, should I be looking at rex for a solution here?
You need a field extraction to do your search, if you select "Extract Fields" from the dropdown next to the events when you run a search, you should be able to feed in the example severities, and Splunk should make a regex for you, which you can then save and use in a search like so:
sourcetype=my_sql_error_log_sourcetype severity>16
You may also be interested in the TA for MS SQL Server 2012