×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question
danast
Engager
Member since: ‎05-01-2018
‎06-05-2020
Community Statistics
Posts 2
Solutions 0
Karma Given 1
Karma Received 0
Member Since ‎05-01-2018
Activity Feed
View All

Re: How to create a Splunk regex to match URI?

by in Splunk Search
‎05-01-2018 11:50 AM
‎05-01-2018 11:50 AM
Rich thanks for the link to the app, I will give it a try later. I asked some sample URLs to be emailed, here they are: http://www.zdp.xu9lb084.IRISHKO.RU/bnhwf28dzmxoo http://ylg.zc90xzeu.mama-bg.ru/aoxzc28jlcabog http://hzm.hzm.6ju4a0t6.river-runningasd.ga/gqnckvx30hxgdtils As you can see the last random character/length string after the domain suffix and / connect all of them. What I am trying to do here is to go through logs and find any urls that have such string. From what I know the length of the string varies between 8-20 characters. Any suggestions for improvement would be appreciated. ... View more

How to create a Splunk regex to match URI?

by in Splunk Search
‎05-01-2018 08:46 AM
‎05-01-2018 08:46 AM
Hi everyone, I am trying to come up with a Splunk regex search for detecting URIs of URLs. What I am interested in is the last random character and length string after the forward slash of the URLs below: txx.zlx.mam-bg.ru/avuTbur334vxasd zlx.axa.babishop18.ml/aipiruqwbXasal2 My fast solution to this so far is: `... | regex uri="^/[a-zA-Z0`-9]{8,20}$" However, I am unable to verify if this works as I don't have access to the logs currently. Any suggestions for improvement would be appreciated. ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:04 AM
Karma given to
View All