Splunk Search

Help with search to create a table

BaharJ
New Member

Hello folks,
I am new to Splunk and need to get a report in CSV file or table.
I like to see only URL and values of parameters in A, B, C, or D column.
There is a chance to have combination of these parameters in URL.
i.e: http//www.XX.com/YY/form/ZZ/test1.html?A=*&B=&C=*&D=
i.e: http//www.XX.com/YY/form/ZZ/test2.html?A=&B=*&C=*
i.e: http//www.XX.com/YY/form/ZZ/test3.html?C=&D=*
All factorial combination of parameters should be show in the report and escape duplicate ones.

This is my sample query:

(splunk_server_group=default OR splunk_server_group=XX) (index=DD) host = "public*web*" "GET //www.XX.com/YY/" AND "/form/ZZ/" AND "/form/" AND ("A=" OR "B=" OR "C=" OR "D=") | rex field=_raw "A=(?[^&]) B=(?[^&]) C=(?[^&]) D=(?[^&])" | dedup A | fields host,url,A,B,C,D | table host url A B C D

Tags (3)
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Try this -

(splunk_server_group=default OR splunk_server_group=XX) (index=DD) host="public*web*" 
"GET //www.XX.com/YY/" AND "/form/ZZ/" AND "/form/" AND ("A=" OR "B=" OR "C=" OR "D=") 
| rex field=_raw "html\?.*?A=(?<AParm>[^&]+)(&|$)"
| rex field=_raw "html\?.*?B=(?<BParm>[^&]+)(&|$)"
| rex field=_raw "html\?.*?C=(?<CParm>[^&]+)(&|$)"
| rex field=_raw "html\?.*?D=(?<DParm>[^&]+)(&|$)"
| fillnull value="((none))" AParm BParm CParm DParm
| dedup AParm 
| fields host, url, AParm, BParm, CParm, DParm 
| table host, url, AParm, BParm, CParm, DParm 

If you want cases where a parameter is present but empty, change the + to * in each rex.

0 Karma

BaharJ
New Member

Thanks for your reply Dal, I have tried different query to make it more clean and simple.
Even this new one gives me same result as top one you shared: (queryParam names are the same, no need to have line 3 to 6), thanks for idea about null values.
Now my missing part is URL, it is not returning the full uel or even some of them are showing null but returning parameter in columns!!
| rex field=_raw "http://(?\/[^?])"
| rex field=_raw "http://(?[^\s]+)\s"
I have consider both of these none of them works fine! (Not able to post < + U + R + L + > after ?)
I was expecting url is returning the real url address! I need to have i.e http//www.XX.com/YY/form/ZZ/test1.html in my table. Or maybe full address with parameter should work fine. i.e. : http//www.XX.com/YY/form/ZZ/test3.html?C=&D=*

(splunk_server_group=default OR splunk_server_group=XX) (index=DD) host="public*web*"
"GET //www.XX.com/YY/" AND "/form/"
| rex field=_raw "http://((?[^\s]+)\s"
| fillnull value="N/A" AParm BParm CParm DParm
| dedup AParm
| fields URL AParm BParm CParm DParm
| table URL, AParm, BParm, CParm, DParm

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...