Skip to content

Instantly share code, notes, and snippets.

@michaellwest

michaellwest/SplunkQuery.txt

Last active January 18, 2023 19:52
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save michaellwest/e370dce28ce6f81c30d6bc57d2b1cde9 to your computer and use it in GitHub Desktop.
Save michaellwest/e370dce28ce6f81c30d6bc57d2b1cde9 to your computer and use it in GitHub Desktop.
Download ZIP
Split query string data into table format with Splunk.
Raw
SplunkQuery.txt
index=iis sourcetype=ms:iis:auto NOT cs_uri_stem="/sitecore/service/keepalive.aspx" NOT cs_User_Agent="*PRTG+Network+Monitor*" cs_uri_stem="/sxa/search/results*" | rex field=cs_uri_query max_match=0 "[\&]?(?<qkey>[^=]+)=(?<qvalue>[^&]+)?"
| eval fields = mvzip(qkey,qvalue)
| mvexpand fields
| eval pairs=split(fields,",")
| eval key=mvindex(pairs,0), value=mvindex(pairs,1)
| fields cs_host cs_uri_query a g q
| eval a=urldecode(a)
| eval g=urldecode(g)
| eval q=urldecode(q)
| stats values(*) as * by cs_uri_query
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment