Request Random Generated SubDomain DGA (Proxy) [splunk-proxy]

(`get_web_data` `get_web_data_proxy`) NOT (site="_*")
| regex site!="(.+)?\d{1,3}[\.\-]\d{1,3}[\.\-]\d{1,3}[\.\-]\d{1,3}(.+)?"
| eval site=mvdedup(site), query = site
| table _time, host, user, answer, message_type, query, record_type, dest_port, protocol_stack, _raw
| stats count values(*) as * values(_raw) as _raw min(_time) as _time by host query
| where count<3
| eval list="mozilla"
| `ut_parse_extended(query, list)`
| eval domain=if(ut_domain_without_tld="None",query,ut_domain)
| rename ut_tld as domain_tld ut_subdomain as subdomain
| fields - ut_* list
| rex field=domain (?<subdomain2>"[^\.]+")
| eval subdomain=if(subdomain="None",subdomain2,subdomain)
| fields - subdomain2
| where len(subdomain)>7
| rex field=subdomain (?<tri1_3>".{3}")?(?<tri1_2>".{3}")?(?<tri1_1>".{3}")"(\..+)?$"
| lookup baseline_trigram_freq_percentiles.csv query_trigrams as tri1_1 OUTPUT percentile as tri1_1_percentile
| lookup baseline_trigram_freq_percentiles.csv query_trigrams as tri1_2 OUTPUT percentile as tri1_2_percentile
| lookup baseline_trigram_freq_percentiles.csv query_trigrams as tri1_3 OUTPUT percentile as tri1_3_percentile
| fillnull value=0
| where tri1_1_percentile+tri1_2_percentile+tri1_3_percentile < 205
| fields - tri*_*
| `ut_shannon(query)`
| rename ut_shannon as query_entropy
| where query_entropy > 2.9
| fields - query_entropy
| stats values(*) as * min(_time) as _time by subdomain host
| eval domain_count=mvcount(domain), domain=case( domain_count=1,"the '".domain."' domain", domain_count>1,"'".mvindex(domain,0)."' and ".(domain_count-1)." other domains")
| stats values(*) as * min(_time) as _time by domain host src_ip
| eval client_ip=src_ip