How to find the redirect request along with its redirected target location?

[santhakr]

When a request comes on domain 1 (say abc.com) we do a 301 redirect to domain 2 (def.com). These will be two separate requests on my server access log. The original one (abc.com) ending up in 301 and the redirected one (def.com) ending up in 200 and both these requests are not synchronous or sequential.

How do I write a query to find the requests on the domain 1 (abc.com) which has redirected to domain 2 (def.com). I basically want to write something below:

domain="abc.com" http_status="301" response_location="def.com"

I don't think there is any response location identifier in splunk or is there one? Any help would be appreciated.

Thanks.

[somesoni2]

You can try using transaction over clientip.

your base search | transaction clientip startswith=http_status=301 endswith=http_status=200 maxevents=2

[santhakr]

One information that can be the same between these two requests can be the client (source) ip. So if the ip remains the same between the original request and the redirected request, how would I map both?

[martin_mueller]

Okay, any other info to tie the two events together?

[santhakr]

Nope, we didn't capture those information in the access log. Moreover the requests can be made by clients on headless mode too, which doesn't retain session information between requests.

[martin_mueller]

Do you have session IDs or cookies in your logs?