Search For CamelCase

[peasead]

Occassionally we see DNS requests that come in using CamelCase (coMpanY.com or COMpaNy.com, etc.) instead of company.com or COMPANY.COM.

Is there a way to search for logs that have CamelCase?

[okrabbe_splunk · Accepted solution]

Interesting question. One option you could try to take is come up with a regex that meets your definition of CamelCase.

I stole this one from a Stack Overflow question:
http://stackoverflow.com/questions/10182664/check-for-camel-case-in-python

You could then match the field using regex:
mysearch | regex domain="(?:[A-Z])(?:\S?)+(?:[A-Z])(?:[a-z])+

This should filter out any results that do not match the regular expression for the domain field. You could also do it on raw if you like.

The other option, which may be easier/more reliable depending on your inclination, would be to write a custom search command in python. There is even an example in the link I gave before.