Domain/URI regex

[Sig1nt]

Hi, I am kind of new to regex and trying to figure out how to construct a regex to match pattern from the web access logs. Below is my requirement.

(1) Match word ("mail" OR "webmail" OR "OWA") in domain/subdomain.
Example: mail.exampledomain.com
mail.sub1.exampledomain.com
mail.sub2.sub1.exampledomain.com
mail.sub3.sub2.sub1.exampledomain.com
(2) Match word "OWA" anywhere in the URI string
Example: exampledomain.com/OWA/login.aspx
exampledomain.com/sub/OWA/login.aspx

[MuS]

Hi Sig1nt,

there are tons of online regex tools like https://regex101.com/ or http://regexr.com/ where you can test.
To answer your questions, see the regex below:

1. (mail)|(webmail)|(OWA)
2. OWA Using the mentioned tools can also provide explanations what happens for each regex.

Hope this helps ...

cheers, MuS

[Sig1nt]

Hi MuS,

Thank you for your time. I will take a look at these sites.

Kind regards,
Sig1nt

[richgalloway]

May we see some examples of your logs, please?

[gfuente]

You should post some example data.

Anyway, Splunk extracts by default the access logs fields if you use the default sourcetype

Regards

[Sig1nt]

Hi, Thank you for your response. Please find below couple of examples of OWA.

xx.xx.xx.xx - - [04/Mar/2015:04:12:22 +0100] "GET /owa/auth/logon.aspx? HTTP/1.1" 200 104 "
https://www.owamail.reading.ac.uk/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fwww.owamail..." "Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.20) Gecko/20081217 Firefox/2.0.0.20"

xx.xx.xx.xx - - [06/Mar/2015:09:58:43 +0100] "GET /asp/Manager/Login.asp?owa=1 HTTP/1.1" 200 104 "https://controlpanel.msoutlookonline.net/asp/Manager/Login.asp?owa=1id=2" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US;) Gecko/20081217 Firefox/2.0.0.20"