- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Wildcard in domain search
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Wildcard in domain search
I'm running a search that looks like this:
index=myindex domain=*mydomain* domain!=*.mydomain.com* domain !=mydomain.someotherdomain.com* , etc..
The purpose is to find domains that were visited containing the keyword 'mydomain' but exclude domains I already know about and trust. The issue that I am running into is that I still receive results containing any subdomain of mydomain, such as a.mydomain.com or apps.mydomain.com.
How can I filter out these results appropriately?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this
index=myindex domain=*.mydomain.* OR domain=mydomain.* | where NOT match(domain,"[\W*\.*]*mydomain.com")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No, fakemydomain.com should not show up in the search result as it is another domain, not the on I am searching for (or a subdomain). It just shares the text 'mydomain'.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In my understanding "fakemydomain.com" should come in the search result (not excluded by filters), isn't it?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
sample addresses please? It may be slow make a regex extract and match with exact value of MYDOMAIN.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
using "domain!=*mydomain.com" would also match results such as "fakemydomain.com", correct? That is one thing I'm trying to avoid.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
A word of warning, wildcards behave oddly when used around breaking characters such as periods. Some background: http://answers.splunk.com/answers/1263/the-asterisk-character-is-not-matching-all-characters-when-do...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
what about "domain!=*mydomain.com" ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Looks good now. Thank you, Martin.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Prefix a search with a newline and four spaces to avoid Splunk Answers treating asterisks as formatting characters.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Looks like my original post ate my wildcards, my query should have been index=myindex domain=*mydomain* domain!=*.mydomain.com* domain !=mydomain.someotherdomain.com* , etc..
So I am already using wildcards. I guess my main question at this point would be is there a better way to filter both mydomain.com and *.mydomain.com with a single filter? Currently it will keep mydomain.com results if I only specificy !=*.mydomain.com and vice versa.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Use "*" as wildcard.
index=myindex domain=*mydomain* NOT (domain=*.mydomain.com OR domain=mydomain.*.com)
Also, provide example events for more accurate suggestions.
Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...
Splunk APM: New Product Features + Community Office Hours Recap!
Index This | Forward, I’m heavy; backward, I’m not. What am I?
