topic Re: How do I capture unique API list my application is using through Splunk? in Getting Data In

How do I capture unique API list my application is using through Splunk?

vijaydudipala88 — Thu, 11 May 2017 17:36:12 GMT

I have paths like this:

https://100.100.100.100:8080/rest/config/L3UCPE-API:services/service-list/{uniqueId}/
https://100.100.100.100:8080/rest/config/L3UCPE-API:services/service-list/{uniqueId}/service-data/oper-status/
https://100.100.100.100:8080/rest/config/L3UCPE-API:services/service-list/{uniqueId}/service-data/ucpe-vms-service-information/ucpe-information/

I tried:

index=abc sourcetype="audit" "|https://100.100.100.100:8080/rest/config/L3UCPE-API:services/service-list/*/|"

The wildcard * is capturing above three as single API, I need them as three separate ones. All help is appreciated.

Re: How do I capture unique API list my application is using through Splunk?

Richfez — Fri, 12 May 2017 01:27:27 GMT

You have these paths inside events?

Also, you have pipe characters inside your search - from that I assume you trimmed the events you are displaying here? Could you instead paste the full event - just pick one, obfuscating if necessary but please try to keep the structure the same?

Re: How do I capture unique API list my application is using through Splunk?

sduff_splunk — Fri, 12 May 2017 05:47:08 GMT

index=abc sourcetype="audit" | rex field=_raw "/service-list/(?<api>[^/]+)/" | stats count by api

The rex command will run a regular expression over the strings, grab the portion that follows /service-list/ and stores it in the field 'api'. The stats count command counts the frequency of each unique api, giving you the usage.

Re: How do I capture unique API list my application is using through Splunk?

vijaydudipala88 — Fri, 12 May 2017 14:49:46 GMT

2017-05-12T14:44:40:995+00:00|2017-05-12T14:44:40:999+00:00|xaxaxabb-eb88-4b9a-xxxx-83xxxx38a6|v2.0/sites/site/mccfl/ports/port/xaxaxabb-eb88-4b9a-xsss-83xxdd38a6|1967149302-19938||https://100.100.100.100:8080/rest/config/L3UCPE-API:services/service-list/{uniqueId}/|admin|COMPLETE|200|||INFO||102.68.207.180|4|nsvncvCkjlh03.infra.cic.goo.net|129.10.80.105||||||||GET

Re: How do I capture unique API list my application is using through Splunk?

vijaydudipala88 — Fri, 12 May 2017 16:00:23 GMT

The portion that follows "/service-list/" is unique id and is followed by "/service-data/oper-status/" ..........so I need count like this:
1. https://100.100.100.100:8080/rest/config/L3UCPE-API:services/service-list/{uniqueId}/service-data/oper-status/ ---1000
2. https://100.100.100.100:8080/rest/config/L3UCPE-API:services/service-list/{uniqueId}/service-data/ucpe-vms-service-information/ucpe-information/ ----970
3. https://100.100.100.100:8080/rest/config/L3UCPE-API:services/service-list/{uniqueId}/ -----500

The 3rd APIs count should not include counts of 1st and 2nd though the path looks like superset of 1 and 2

Re: How do I capture unique API list my application is using through Splunk?

sduff_splunk — Sat, 13 May 2017 03:46:57 GMT