topic Re: How to write a transaction search where startswith starts with event A, while endswith must match a regex in Splunk Search

How to write a transaction search where startswith starts with event A, while endswith must match a regex

phudinhha — Thu, 09 Jul 2015 18:08:09 GMT

I need to find a sequence of activity that always start with:
http://abc.com/abc.html
http://abc.com/end.xvz?....

so I tried to uses this search query:

index=sourceindex | transaction maxspan=30s startswith=url="/abc.html" endswith=eval(match(url,"^\/\w+\.\w+")

However, the return result is 0 event.

Is there anyway that I can refine it?

Thank you so much

Re: How to write a transaction search where startswith starts with event A, while endswith must match a regex

phudinhha — Thu, 09 Jul 2015 19:22:26 GMT

Dear woodcock,
The return result is 0 event. However, when i omit the "endswith" part, the expected "end.xvz?...." also shows in the event tab as a part of "/abc.html" event. What does it mean?

Re: How to write a transaction search where startswith starts with event A, while endswith must match a regex

woodcock — Thu, 09 Jul 2015 19:33:24 GMT

Try this:

 index=sourceindex | rex field=url "(?<url_front>[^\?]*)\/(?<url_back>.*)" | transaction url_front maxspan=30s endswith=eval(match(url_back,"end.xyz"))

Actually, you may not even need the endswith part (which I know is wrong because I don't know what you are trying to match exactly).

Re: How to write a transaction search where startswith starts with event A, while endswith must match a regex

phudinhha — Thu, 09 Jul 2015 19:52:32 GMT

I recognized the pattern in network activities like this.

http://123.com/abc.html
http://123.com/end.xvz?....

AND

http://456.com/abc.html
http://456.com/quiz.one?...

So I want to use transaction to look for a sequence of activity that starts with "abc.html" and ends with ""^/w+.w+".

Re: How to write a transaction search where startswith starts with event A, while endswith must match a regex

woodcock — Thu, 09 Jul 2015 19:56:29 GMT

Your RegEx will never match (even if url has http:// removed). To make it match, use something like this:

 index=sourceindex | transaction maxspan=30s startswith=url="/abc.html" endswith=eval(match(url,"\w+\.\w+\?")