Splunk Search

How to write regex to extract Bing and Yahoo search from proxySG logs?

ThomasLeroy
Explorer

Hello,

I would like to extract bing and yahoo search from my proxySG logs.

i have this for yahoo search search yahoo 443 /search ?p=splunk&ei=UTF-8&fr=moz35 .
i use this regex to get the search p=(?[^&]+)

and i have this for bing www bing com/ search?q=splunk&qs=n&form=QBRE

Splunk always put the two in the same fields
is there a way to make a difference between yahoo and bing search ?

Thank you

1 Solution

MuS
SplunkTrust
SplunkTrust

Hi ThomasLeroy,

based on your provided data, try this:

your base search here 
| rex "yahoo.+\?p\=(?<YahooSearch>[^&]+)|bing.+\?q\=(?<BingSearch>[^&]+)" 
| table YahooSearch BingSearch

hope this helps to get you started ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi ThomasLeroy,

based on your provided data, try this:

your base search here 
| rex "yahoo.+\?p\=(?<YahooSearch>[^&]+)|bing.+\?q\=(?<BingSearch>[^&]+)" 
| table YahooSearch BingSearch

hope this helps to get you started ...

cheers, MuS

MuS
SplunkTrust
SplunkTrust

you're welcome

0 Karma

ThomasLeroy
Explorer

work as expected

Thank !

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>