topic Re: SQL Language - Pull all URLs with specific query string parameters. in All Apps and Add-ons

SQL Language - Pull all URLs with specific query string parameters.

alagiriv — Thu, 10 Jan 2019 20:22:41 GMT

I need help pulling URLs that have a specific query string.

For example, I get all URLs for the matching query strings. Query string can be in any order.

abc.com/?a=1&b=2
abc.com/?c=1
abc.com/?d=1&a=2
List all that have a=? or b=? in the URL

abc.com/?a=1&b=2
abc.com/?d=1&a=2

Re: SQL Language - Pull all URLs with specific query string parameters.

seegeekrun — Thu, 10 Jan 2019 20:48:46 GMT

There are several ways that it could be approached, but one rough way would be as follows:

| makeresults 
| eval path = "abc.com/?a=1&b=2 abc.com/?c=1 abc.com/?d=1&a=2" 
| makemv path 
| mvexpand path 
| rename COMMENT AS "Everything above generates sample event data; everything below is your solution" 
| makemv path delim="?"
| eval params=mvindex(path,1)
| makemv params delim="&"
| mvexpand params | stats values(path) as Paths by params

Re: SQL Language - Pull all URLs with specific query string parameters.

msivill_splunk — Wed, 16 Jan 2019 16:41:35 GMT

Another example, which is self-contained. Everything up to and including the eval url is generating the test data.

| makeresults count=4 
| streamstats count 
| eval url = case( count==1, "http://abc.com/?a=1&b=2&c=3", count==2, "http://abc.com/?d=1&e=2&a=3", count==3, "http://abc.com/?f=1&g=2&h=3", count==4, "http://abc.com/?C=1&b=2&a=3") 
| rex field=url "[^?]*\?(?<url_path>.*)" 
| eval key_values = split(url_path, "&") 
| eval matching_keys=mvfilter(match(key_values, "a=") OR match(key_values, "b=")) 
| where isnotnull(matching_keys) 
| table url, url_path, matching_keys

Re: SQL Language - Pull all URLs with specific query string parameters.

John2 — Tue, 11 Jan 2022 00:00:21 GMT

Could it be as simple as this?

A search with an implied "AND", using a space:

"abc.com" ("a=" OR "b=")