Hello Fellow Splunkers,
I am trying to write a search to compare the sitename and referrer to find all results where the referrer is different than the site. The problem is the referrer comes in as the full URL and the sitename is the base domain with no URI information.
For example:
sitename=www.google.com
referrer=hxxp://www.drive.google.com/blah-blah-uri-stuff
The search I have so far is comparing exact matches, so providing incorrect results.
sourcetype=proxy | eval status =if(match(s_sitename,cs_referrer),"True","False") | table sitename, referrer, username
Any ideas?
... View more