topic Re: Make field reference after a certain value in Splunk Search

Make field reference after a certain value

LeandroKopke — Wed, 30 Sep 2020 00:04:43 GMT

I have a query that has two native fields, they are "referenced_host" and "url".
I performed the extraction of the "referenced_host" field by naming it as the domain.
The problem is that the domain field comes empty whenever the URL field contains "HTTPS" values.

Example:

"Referenced_host" field value = ctldl.windowsupdate.com
Domain field value = ctldl.windowsupdate.com
URL field value = http://ctldl.windowsupdate.com/msdownload/update/v3/stati (...)

Example 2:

Referenced_host field value = null
Domain field value = null
URL field value = https://www.facebook.com

Would I have to make the domain field assume the value of the URL field, every time the URL field has values beginning with "HTTPS"?

Re: Make field reference after a certain value

richgalloway — Thu, 11 Apr 2019 14:56:30 GMT

How are you extracting the referenced_host field? You probably need to modify the extraction to recognize 'https'.

Re: Make field reference after a certain value

LeandroKopke — Wed, 30 Sep 2020 00:04:56 GMT

Extraction of the domain field was done based on the referenced_host field.
It turns out that every time the URL field comes with "HTTPS" the referenced_host field is empty, making the domain field also empty.
I need every time the URL field has values with "HTTPS" the domain field assumes this value and every time the URL field comes with "HTTP" values the domain field assumes the values of the referenced_host field.

Re: Make field reference after a certain value

dmarling — Thu, 11 Apr 2019 17:41:46 GMT

The referenced host field extraction should be this so you get both http and https prefixed domains:

| rex field=URL "https?:\/\/(?<domain>[^\/\s]+)"

The "s?" in the regular expression means match 1 or 0 times so if a "s" is present it will still proceed to where the domain is located on your url.

Here's a link to this picking up both domain's you listed as examples in regex101: https://regex101.com/r/aFKeoc/1