extracting time-taken field from IIS logs

We need to start alerting on the results of the IIS time taken field. Any idea how to extract that field so it can be easily searched? I am hasving no luck at all.

example output

2012-04-25 21:23:31 ::1 POST /PU.PDS.ExternalServices/SolutionExecution/ExternalSolutionExecution.svc - 80 - ::1 - 200 0 0 11734

I need to sertup an alert on the last field output "11734" when it gets over 10000.

Thanks!

asked 26 Apr '12, 10:55

ebailey
21●2
accept rate: 0%

One Answer:

oldest newest most voted

1	Try to see if adding this in your search works. sourcetype=iis_logs\| rex "(?<time_taken>w)$" See if the field time_taken is matching the last digits correctly. Then create an alert and make it alert if time_taken > 10000 link answered 26 Apr '12, 13:38* roumys 11●2 accept rate: 0%

Post your answer

toggle preview

Follow this question

Email:

RSS:

Answers

Answers + Comments

Markdown Basics

*italic* or _italic_
**bold** or __bold__
link:[text](http://url.com/ "Title")
image?![alt text](/path/img.jpg "Title")
numbered list: 1. Foo 2. Bar
to add a line break simply add two spaces to where you would like the new line to be.
basic HTML tags are also supported

learn more about Markdown

Tags:

splunk ×531
savedsearch ×258
iis ×78
extract ×59

Asked: 26 Apr '12, 10:55

Seen: 1,032 times

Last updated: 26 Apr '12, 13:38

extracting time-taken field from IIS logs

Follow this question

Splunk Resources

Related questions