How can I compare these two fields?

[laurazeno]

Hello Fellow Splunkers,

I am trying to write a search to compare the sitename and referrer to find all results where the referrer is different than the site. The problem is the referrer comes in as the full URL and the sitename is the base domain with no URI information.

For example:
sitename=www.google.com
referrer=hxxp://www.drive.google.com/blah-blah-uri-stuff

The search I have so far is comparing exact matches, so providing incorrect results.

sourcetype=proxy | eval status =if(match(s_sitename,cs_referrer),"True","False") | table sitename, referrer, username

Any ideas?

[somesoni2]

Try like this

| gentimes start=-1 | eval sitename="www.google.com" | eval referrer="http://www.drive.google.com/blah-blah-uri-stuff" 
| table sitename referrer 
| eval result=if(like(referrer,"%".replace(sitename,"www","")."%"),"True","False")

[somesoni2]

Line 1 is just to generate data, just use the if command.

[sheamus69]

My regex skills are not awesome, but presumably this is a perfect situation to apply some regex logic to extract the domain name from both sitename and referrer?

[ddrillic]

To understand it better, I broke it a bit to pieces -

     | gentimes start=-1 
     | eval  sitename="www.google.com" 
     | eval  referrer="http://www.drive.google.com/blah-blah-uri-stuff" 
     | table sitename referrer 
     | eval  sitename=replace(sitename,"www","")
     | eval  result=if(like(referrer,"%".sitename."%"),"True","False")