topic Re: Defining 1 field that appears 2 different ways for an old and new REST API? in All Apps and Add-ons

Defining 1 field that appears 2 different ways for an old and new REST API?

boris — Tue, 03 Apr 2012 00:16:54 GMT

What is the best approach to defining a field (the user API key field) that in our logs appears in 2 different ways because we take different requests from both an old and a new REST interface?

The apiKey field exists in each REST API differently:

Request API Version 1:

 /2.0/APIKEY-GOES-HERE/query.json?param1=value1&param2=value2

Request API Version 2:

/query.json?apikey=APIKEY-GOES-HERE&param1=value1&param2=value2

Re: Defining 1 field that appears 2 different ways for an old and new REST API?

gkanapathy — Tue, 03 Apr 2012 00:32:30 GMT

You can simply either define two extractions, or a single extraction with an alternating regex. An extraction that fails will simply have no effect (other than the consume the resources of checking for the match).

e.g.:

EXTRACT-v1 = /2.0/(?<apikey>[^\/]*)/ from uri
EXTRACT-v2 = /query.json?apikey=(?<apikey>[^\=\&]*) from uri

The second extract could also be performed automatically by an appropriate KV extraction using DELIMS or KV_MODE.

Re: Defining 1 field that appears 2 different ways for an old and new REST API?

boris — Mon, 09 Apr 2012 17:13:22 GMT

For the novice: gkanapathy answer of using alternating regex refers to using "OR" with a '|' within the regex. See my below solution:

EXTRACT-v3 = (/2`\`.0/|apikey=)(?<apikey>[^\/]*)/

Re: Defining 1 field that appears 2 different ways for an old and new REST API?

boris — Mon, 16 Apr 2012 16:53:06 GMT

Field aliases to normalize different field names

Source: http://docs.splunk.com/Documentation/Splunk/4.3.1/User/TagAndAliasFieldValues

Quote from docs:

"
Alias field names

You can add multiple aliases to a field name or use these field aliases to normalize different field names. This does not rename or remove the original field name. After you alias a field, you can search for it using any of its name aliases. To alias a field name, you need to have access to props.conf. For information on how to do this, see Create aliases for fields in the Knowledge Manager manual.
"