topic Domain/URI regex in Splunk Search

Domain/URI regex

Sig1nt — Mon, 09 Mar 2015 14:05:01 GMT

Hi, I am kind of new to regex and trying to figure out how to construct a regex to match pattern from the web access logs. Below is my requirement.

(1) Match word ("mail" OR "webmail" OR "OWA") in domain/subdomain.
Example: mail.exampledomain.com
mail.sub1.exampledomain.com
mail.sub2.sub1.exampledomain.com
mail.sub3.sub2.sub1.exampledomain.com
(2) Match word "OWA" anywhere in the URI string
Example: exampledomain.com/OWA/login.aspx
exampledomain.com/sub/OWA/login.aspx

Re: Domain/URI regex

gfuente — Mon, 09 Mar 2015 14:10:18 GMT

You should post some example data.

Anyway, Splunk extracts by default the access logs fields if you use the default sourcetype

Regards

Re: Domain/URI regex

richgalloway — Mon, 09 Mar 2015 14:10:59 GMT

May we see some examples of your logs, please?

Re: Domain/URI regex

MuS — Mon, 09 Mar 2015 14:15:37 GMT

Hi Sig1nt,

there are tons of online regex tools like https://regex101.com/ or http://regexr.com/ where you can test.
To answer your questions, see the regex below:

(mail)|(webmail)|(OWA)
OWA Using the mentioned tools can also provide explanations what happens for each regex.

Hope this helps ...

cheers, MuS

Re: Domain/URI regex

Sig1nt — Mon, 09 Mar 2015 14:36:26 GMT

Hi, Thank you for your response. Please find below couple of examples of OWA.

xx.xx.xx.xx - - [04/Mar/2015:04:12:22 +0100] "GET /owa/auth/logon.aspx? HTTP/1.1" 200 104 "
https://www.owamail.reading.ac.uk/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fwww.owamail.reading.ac.uk%2fowa%2f" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.20) Gecko/20081217 Firefox/2.0.0.20"

xx.xx.xx.xx - - [06/Mar/2015:09:58:43 +0100] "GET /asp/Manager/Login.asp?owa=1 HTTP/1.1" 200 104 "https://controlpanel.msoutlookonline.net/asp/Manager/Login.asp?owa=1id=2" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US;) Gecko/20081217 Firefox/2.0.0.20"

Re: Domain/URI regex

Sig1nt — Mon, 09 Mar 2015 14:38:23 GMT

Hi MuS,

Thank you for your time. I will take a look at these sites.

Kind regards,
Sig1nt