Splunk Enterprise Security

How to search for specific words in URL

ADCW7TQ
Explorer

index=* youtube user | table _time, user, host, src, dest, bytes_in, bytes_out, url

This is my simple query. I would like to get result for some specific words from the observed youtube URL in results.


eg:

https://www.youtube.com/pyv_embed?video_id=nMqETeQrgqU&use_player=0&ad_type=watch_related&headline=J...


The above is the "result as per my query. How to do a specific word search in the URL? Like "movies", "keanu reeves" "trailer"

Just want to know, what kind of youtube URL the user has accessed.

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

You can utilize the match function of where clause to search for specific keywords

index=* youtube user | table _time, user, host, src, dest, bytes_in, bytes_out, url | where match(url,"keenu") OR match(url,"movie") OR...

OR use the regular Splunk search filter like this

index=* youtube user (url=*keenu* OR url=*movie* OR...) | table _time, user, host, src, dest, bytes_in, bytes_out, url

View solution in original post

felipecerda
Path Finder

If you want to know what the URLs contain you could also extract what the descriptions say using regex. Something like:

index=* youtube user | rex field=_raw "&description1=(?<desc1>.*),&" | table _time, user, host, src, dest, bytes_in, bytes_out, url, desc1
0 Karma

ADCW7TQ
Explorer

Well, May i know how to use this regex query? As it as or i need to replace any words in the description part.

rex field=_raw "&description1=(?.*),&"

0 Karma

ADCW7TQ
Explorer

Thanks!!!

However, i am getting the same result as before. But the 'desc1' column came blank in the result.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You can utilize the match function of where clause to search for specific keywords

index=* youtube user | table _time, user, host, src, dest, bytes_in, bytes_out, url | where match(url,"keenu") OR match(url,"movie") OR...

OR use the regular Splunk search filter like this

index=* youtube user (url=*keenu* OR url=*movie* OR...) | table _time, user, host, src, dest, bytes_in, bytes_out, url

ADCW7TQ
Explorer

Thanks a lot..

It works, addition to this query. May i get the answer for bytes_in & bytes_out in MB??

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...