Splunk Search

How to write regex to extract Bing and Yahoo search from proxySG logs?

ThomasLeroy
Explorer

Hello,

I would like to extract bing and yahoo search from my proxySG logs.

i have this for yahoo search search yahoo 443 /search ?p=splunk&ei=UTF-8&fr=moz35 .
i use this regex to get the search p=(?

[^&]+)

and i have this for bing www bing com/ search?q=splunk&qs=n&form=QBRE

Splunk always put the two in the same fields
is there a way to make a difference between yahoo and bing search ?

Thank you

1 Solution

MuS
Legend

Hi ThomasLeroy,

based on your provided data, try this:

your base search here 
| rex "yahoo.+\?p\=(?<YahooSearch>[^&]+)|bing.+\?q\=(?<BingSearch>[^&]+)" 
| table YahooSearch BingSearch

hope this helps to get you started ...

cheers, MuS

View solution in original post

MuS
Legend

Hi ThomasLeroy,

based on your provided data, try this:

your base search here 
| rex "yahoo.+\?p\=(?<YahooSearch>[^&]+)|bing.+\?q\=(?<BingSearch>[^&]+)" 
| table YahooSearch BingSearch

hope this helps to get you started ...

cheers, MuS

MuS
Legend

you're welcome

0 Karma

ThomasLeroy
Explorer

work as expected

Thank !

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...