I am seeking to get a list of the user typed keyword searches from the proxy activity. Below is what i got but those seem to be the referred or suggested keyword which can be deceitful and false positive. index=main user_id=splunky AND x_webcat_code_full!="Advertisements" | fields _time, bytes_in, bytes_out, dest_domain, dest_url, dvc_ip, user_id, x_webcat_code_full | rex field=dest_url "\?q\=(?<search_term>[^&]+)\&" | stats values(search_term) something that strip out the link below and just providing me just "hp elitebook 840 g3" if that make sense? https://www.google.com:443/search?ei=TO-WX_zcF5mDtQbczYCIBg&q=hp+elitebook+840+g3+drivers&oq=hp+elitebook+840+g3+d&gs_lcp=CgZwc3ktYWIQAxgAMgUIABDJAzICCAAyAggAMgIIADICCAAyAggAMgIIADICCAAyAggAMgIIADoECAAQRzoKCAAQsQMQyQMQQzoECAAQQzoHCAAQsQMQQzoFCAAQsQM6BwgAEMkDEENQrh1Yjndg44cBaABwAngAgAHZAYgBsQeSAQUwLjUuMZgBAKABAaoBB2d3cy13aXrIAQjAAQE&sclient=psy-ab
... View more