topic Re: Filter by URL in Splunk Search

Filter by URL

roseb — Wed, 09 Aug 2017 02:19:26 GMT

How do we filter by URL?
I use the search criteria below, however, I'm trying to figure out how will I filter the results by URL (e.g. facebook.com)
eventtype=AllBrowsing user= |table user url

Thanks in advance.

Re: Filter by URL

martin_mueller — Wed, 09 Aug 2017 07:23:19 GMT

Add as many filters as you like to your initial search:

eventtype=AllBrowsing user=something url=facebook.com | table user url

That's assuming the entire url value is literally facebook.com, otherwise you'd probably want to extract the host name from the url and filter on that.

Re: Filter by URL

roseb — Wed, 09 Aug 2017 07:39:09 GMT

Hi Martin,

Thanks for your thorough answer.

The url value is not exactly facebook.com. It could be anything after the url like "facebook.com/posts/123"
Can I add a wildcard entry like url=facebook.com/* or how do I do your recommendation "extract the host name from the url and filter on that"?

🙂

Re: Filter by URL

martin_mueller — Wed, 09 Aug 2017 07:52:36 GMT

You can add wildcards, e.g. url=facebook.com/*. I highly recommend going through the tutorial at http://docs.splunk.com/Documentation/Splunk/6.6.2/SearchTutorial/WelcometotheSearchTutorial

There is endless information in the docs, including how to work with fields: http://docs.splunk.com/Documentation/Splunk/6.6.2/Knowledge/Aboutfields