https://community.splunk.com/t5/Splunk-Search/How-to-find-the-redirect-request-along-with-its-redirected/m-p/199581#M187518 <P>One information that can be the same between these two requests can be the client (source) ip. So if the ip remains the same between the original request and the redirected request, how would I map both?</P> Wed, 26 Mar 2014 19:02:51 GMT santhakr 2014-03-26T19:02:51Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-redirect-request-along-with-its-redirected/m-p/199577#M187514 <P>When a request comes on domain 1 (say abc.com) we do a 301 redirect to domain 2 (def.com). These will be two separate requests on my server access log. The original one (abc.com) ending up in 301 and the redirected one (def.com) ending up in 200 and both these requests are not synchronous or sequential.</P> <P>How do I write a query to find the requests on the domain 1 (abc.com) which has redirected to domain 2 (def.com). I basically want to write something below:</P> <P>domain="abc.com" http_status="301" response_location="def.com"</P> <P>I don't think there is any response location identifier in splunk or is there one? Any help would be appreciated.</P> <P>Thanks.</P> Mon, 28 Sep 2020 16:14:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-redirect-request-along-with-its-redirected/m-p/199577#M187514 santhakr 2020-09-28T16:14:30Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-redirect-request-along-with-its-redirected/m-p/199578#M187515 <P>Do you have session IDs or cookies in your logs?</P> Wed, 26 Mar 2014 18:37:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-redirect-request-along-with-its-redirected/m-p/199578#M187515 martin_mueller 2014-03-26T18:37:10Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-redirect-request-along-with-its-redirected/m-p/199579#M187516 <P>Nope, we didn't capture those information in the access log. Moreover the requests can be made by clients on headless mode too, which doesn't retain session information between requests.</P> Wed, 26 Mar 2014 18:47:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-redirect-request-along-with-its-redirected/m-p/199579#M187516 santhakr 2014-03-26T18:47:35Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-redirect-request-along-with-its-redirected/m-p/199580#M187517 <P>Okay, any other info to tie the two events together?</P> Wed, 26 Mar 2014 18:50:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-redirect-request-along-with-its-redirected/m-p/199580#M187517 martin_mueller 2014-03-26T18:50:25Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-redirect-request-along-with-its-redirected/m-p/199581#M187518 <P>One information that can be the same between these two requests can be the client (source) ip. So if the ip remains the same between the original request and the redirected request, how would I map both?</P> Wed, 26 Mar 2014 19:02:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-redirect-request-along-with-its-redirected/m-p/199581#M187518 santhakr 2014-03-26T19:02:51Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-redirect-request-along-with-its-redirected/m-p/199582#M187519 <P>You can try using transaction over clientip.</P> <P>your base search | transaction clientip startswith=http_status=301 endswith=http_status=200 maxevents=2</P> Mon, 28 Sep 2020 16:14:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-redirect-request-along-with-its-redirected/m-p/199582#M187519 somesoni2 2020-09-28T16:14:35Z