Splunk Search

How to write regex to extract Bing and Yahoo search from proxySG logs?

ThomasLeroy
Explorer

Hello,

I would like to extract bing and yahoo search from my proxySG logs.

i have this for yahoo search search yahoo 443 /search ?p=splunk&ei=UTF-8&fr=moz35 .
i use this regex to get the search p=(?

[^&]+)

and i have this for bing www bing com/ search?q=splunk&qs=n&form=QBRE

Splunk always put the two in the same fields
is there a way to make a difference between yahoo and bing search ?

Thank you

1 Solution

MuS
Legend

Hi ThomasLeroy,

based on your provided data, try this:

your base search here 
| rex "yahoo.+\?p\=(?<YahooSearch>[^&]+)|bing.+\?q\=(?<BingSearch>[^&]+)" 
| table YahooSearch BingSearch

hope this helps to get you started ...

cheers, MuS

View solution in original post

MuS
Legend

Hi ThomasLeroy,

based on your provided data, try this:

your base search here 
| rex "yahoo.+\?p\=(?<YahooSearch>[^&]+)|bing.+\?q\=(?<BingSearch>[^&]+)" 
| table YahooSearch BingSearch

hope this helps to get you started ...

cheers, MuS

MuS
Legend

you're welcome

0 Karma

ThomasLeroy
Explorer

work as expected

Thank !

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...