Splunk Search

How can I compare these two fields?

laurazeno
Explorer

Hello Fellow Splunkers,

I am trying to write a search to compare the sitename and referrer to find all results where the referrer is different than the site. The problem is the referrer comes in as the full URL and the sitename is the base domain with no URI information.

For example:
sitename=www.google.com
referrer=hxxp://www.drive.google.com/blah-blah-uri-stuff

The search I have so far is comparing exact matches, so providing incorrect results.

sourcetype=proxy | eval status =if(match(s_sitename,cs_referrer),"True","False") | table sitename, referrer, username

Any ideas?

0 Karma

somesoni2
Revered Legend

Try like this

| gentimes start=-1 | eval sitename="www.google.com" | eval referrer="http://www.drive.google.com/blah-blah-uri-stuff" 
| table sitename referrer 
| eval result=if(like(referrer,"%".replace(sitename,"www","")."%"),"True","False")
0 Karma

somesoni2
Revered Legend

Line 1 is just to generate data, just use the if command.

0 Karma

sheamus69
Communicator

My regex skills are not awesome, but presumably this is a perfect situation to apply some regex logic to extract the domain name from both sitename and referrer?

0 Karma

ddrillic
Ultra Champion

To understand it better, I broke it a bit to pieces -

     | gentimes start=-1 
     | eval  sitename="www.google.com" 
     | eval  referrer="http://www.drive.google.com/blah-blah-uri-stuff" 
     | table sitename referrer 
     | eval  sitename=replace(sitename,"www","")
     | eval  result=if(like(referrer,"%".sitename."%"),"True","False")
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...