Hi, I am kind of new to regex and trying to figure out how to construct a regex to match pattern from the web access logs. Below is my requirement.
(1) Match word ("mail" OR "webmail" OR "OWA") in domain/subdomain.
Example: mail.exampledomain.com
mail.sub1.exampledomain.com
mail.sub2.sub1.exampledomain.com
mail.sub3.sub2.sub1.exampledomain.com
(2) Match word "OWA" anywhere in the URI string
Example: exampledomain.com/OWA/login.aspx
exampledomain.com/sub/OWA/login.aspx
Hi Sig1nt,
there are tons of online regex tools like https://regex101.com/ or http://regexr.com/ where you can test.
To answer your questions, see the regex below:
(mail)|(webmail)|(OWA)
OWA
Using the mentioned tools can also provide explanations what happens for each regex.Hope this helps ...
cheers, MuS
Hi MuS,
Thank you for your time. I will take a look at these sites.
Kind regards,
Sig1nt
May we see some examples of your logs, please?
You should post some example data.
Anyway, Splunk extracts by default the access logs fields if you use the default sourcetype
Regards
Hi, Thank you for your response. Please find below couple of examples of OWA.
xx.xx.xx.xx - - [04/Mar/2015:04:12:22 +0100] "GET /owa/auth/logon.aspx? HTTP/1.1" 200 104 "
https://www.owamail.reading.ac.uk/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fwww.owamail..." "Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.20) Gecko/20081217 Firefox/2.0.0.20"
xx.xx.xx.xx - - [06/Mar/2015:09:58:43 +0100] "GET /asp/Manager/Login.asp?owa=1 HTTP/1.1" 200 104 "https://controlpanel.msoutlookonline.net/asp/Manager/Login.asp?owa=1id=2" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US;) Gecko/20081217 Firefox/2.0.0.20"