Splunk Search

How to write regex to extract Bing and Yahoo search from proxySG logs?

ThomasLeroy
Explorer

Hello,

I would like to extract bing and yahoo search from my proxySG logs.

i have this for yahoo search search yahoo 443 /search ?p=splunk&ei=UTF-8&fr=moz35 .
i use this regex to get the search p=(?[^&]+)

and i have this for bing www bing com/ search?q=splunk&qs=n&form=QBRE

Splunk always put the two in the same fields
is there a way to make a difference between yahoo and bing search ?

Thank you

1 Solution

MuS
Legend

Hi ThomasLeroy,

based on your provided data, try this:

your base search here 
| rex "yahoo.+\?p\=(?<YahooSearch>[^&]+)|bing.+\?q\=(?<BingSearch>[^&]+)" 
| table YahooSearch BingSearch

hope this helps to get you started ...

cheers, MuS

View solution in original post

MuS
Legend

Hi ThomasLeroy,

based on your provided data, try this:

your base search here 
| rex "yahoo.+\?p\=(?<YahooSearch>[^&]+)|bing.+\?q\=(?<BingSearch>[^&]+)" 
| table YahooSearch BingSearch

hope this helps to get you started ...

cheers, MuS

MuS
Legend

you're welcome

0 Karma

ThomasLeroy
Explorer

work as expected

Thank !

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...