Splunk Search

Domain/URI regex

Sig1nt
New Member

Hi, I am kind of new to regex and trying to figure out how to construct a regex to match pattern from the web access logs. Below is my requirement.

(1) Match word ("mail" OR "webmail" OR "OWA") in domain/subdomain.
Example: mail.exampledomain.com
mail.sub1.exampledomain.com
mail.sub2.sub1.exampledomain.com
mail.sub3.sub2.sub1.exampledomain.com
(2) Match word "OWA" anywhere in the URI string
Example: exampledomain.com/OWA/login.aspx
exampledomain.com/sub/OWA/login.aspx

Tags (1)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi Sig1nt,

there are tons of online regex tools like https://regex101.com/ or http://regexr.com/ where you can test.
To answer your questions, see the regex below:

  1. (mail)|(webmail)|(OWA)
  2. OWA Using the mentioned tools can also provide explanations what happens for each regex.

Hope this helps ...

cheers, MuS

Sig1nt
New Member

Hi MuS,

Thank you for your time. I will take a look at these sites.

Kind regards,
Sig1nt

0 Karma

richgalloway
SplunkTrust
SplunkTrust

May we see some examples of your logs, please?

---
If this reply helps you, Karma would be appreciated.
0 Karma

gfuente
Motivator

You should post some example data.

Anyway, Splunk extracts by default the access logs fields if you use the default sourcetype

Regards

0 Karma

Sig1nt
New Member

Hi, Thank you for your response. Please find below couple of examples of OWA.

xx.xx.xx.xx - - [04/Mar/2015:04:12:22 +0100] "GET /owa/auth/logon.aspx? HTTP/1.1" 200 104 "
https://www.owamail.reading.ac.uk/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fwww.owamail..." "Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.20) Gecko/20081217 Firefox/2.0.0.20"

xx.xx.xx.xx - - [06/Mar/2015:09:58:43 +0100] "GET /asp/Manager/Login.asp?owa=1 HTTP/1.1" 200 104 "https://controlpanel.msoutlookonline.net/asp/Manager/Login.asp?owa=1id=2" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US;) Gecko/20081217 Firefox/2.0.0.20"

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...