topic Re: Regex to find if there are two ? symbols in the url in Splunk Search

How to create a regex that gives the count, if the url string has two question mark symbols (not consecutive though)?

sanvica — Thu, 31 Mar 2022 16:49:40 GMT

Hi Experts,

I have an issue with the search string, I have a url text like below and I need to filter that out using regex. I am not able to create a regex that would give the count if the url string has two question mark symbols, not consecutive though.

/shop/us/aabc-abc-aaa?filtered=true&rows=240&start=0&facet=ads_f42001_ntk_cs:(%22aaa-Babbab%22)&cmp=DIS:SPR22:HCo:M:US:PSP:TT:X:X:X:JEANS:X:JEAN:X:JanWk4AABBBs15s

Thanks

Re: Regex to find if there are two ? symbols in the url

ITWhisperer — Thu, 31 Mar 2022 07:23:33 GMT

| regex url="\?[^\?]+\?"

Re: Regex to find if there are two ? symbols in the url

yuanliu — Thu, 31 Mar 2022 15:05:55 GMT

To count how many occurrences, use mvcount

| rex field=url max_match=0 "\?(?<param>[^?]+)" | eval qcount = mvcount(param)

e.g., url="/shop/us/aabc-abc-aaa?filtered=true&rows=240&start=0&facet=ads_f42001_ntk_cs:(%22aaa-Babbab%22)&cmp=DIS:SPR22:HCo:M:US:PSP:TT:X:X:X:JEANS:X:JEAN:X:JanWk4AABBBs15s" gives

param	qcount	url
filtered=true&rows=240&start=0&facet=ads_f42001_ntk_cs:(%22aaa-Babbab%22)&cmp=DIS:SPR22:HCo:M:US:PSP:TT:X:X:X:JEANS:X:JEAN:X:JanWk4AABBBs15s	1	/shop/us/aabc-abc-aaa?filtered=true&rows=240&start=0&facet=ads_f42001_ntk_cs:(%22aaa-Babbab%22)&cmp=DIS:SPR22:HCo:M:US:PSP:TT:X:X:X:JEANS:X:JEAN:X:JanWk4AABBBs15s

whereas url="/shop/us/aabc-abc-aaa?filtered=true&rows=240&start=0&facet=ads_f42001_ntk_cs:(%22aaa-Babbab%22)?cmp=DIS:SPR22:HCo:M:US:PSP:TT:X:X:X👖X:JEAN:X:JanWk4AABBBs15s" gives

param	qcount	url
filtered=true&rows=240&start=0&facet=ads_f42001_ntk_cs:(%22aaa-Babbab%22) cmp=DIS:SPR22:HCo:M:US:PSP:TT:X:X:X:JEANS:X:JEAN:X:JanWk4AABBBs15s	2	/shop/us/aabc-abc-aaa?filtered=true&rows=240&start=0&facet=ads_f42001_ntk_cs:(%22aaa-Babbab%22)?cmp=DIS:SPR22:HCo:M:US:PSP:TT:X:X:X:JEANS:X:JEAN:X:JanWk4AABBBs15s