topic Re: Search an endpoint ending with numbers in Splunk Search

Search an endpoint ending with numbers

newtosplunk14 — Fri, 06 Aug 2021 07:15:01 GMT

I want to search for endpoints /api/work/12345678 i.e api/work/(8 digt number). My below query gives me all the three endpoint in the logs. I just only want the ones that are /api/work/12345678.

Search Query - cf_app_name="preval" cf_space_name="prod" msg="*/api/jobs/*"

My logs contain

msg: abc - [2021-08-06T06:49:11.529+0000] "GET /api/work/12345678/data HTTP/1.1" 200 0 407 "-" "Java/1.8.0_222"

msg: abc - [2021-08-06T06:49:11.529+0000] "GET /api/work/12345678 HTTP/1.1" 200 0 407 "-" "Java/1.8.0_222"

msg: abc - [2021-08-06T06:49:11.529+0000] "GET /api/work/12345678/photo HTTP/1.1" 200 0 407 "-" "Java/1.8.0_222"

Thanks

Re: Search an endpoint ending with numbers

venkatasri — Fri, 06 Aug 2021 07:30:45 GMT

Hi @newtosplunk14

Try this,

cf_app_name="preval" cf_space_name="prod" | regex "\/api\/work\/\d+"

An upvote would be appreciated and Accept solution if this reply helps!

Re: Search an endpoint ending with numbers

ITWhisperer — Fri, 06 Aug 2021 08:22:07 GMT

If msg is a field which is already extracted, you can use this - note the \s in the pattern to terminate the URI

cf_app_name="preval" cf_space_name="prod" | regex msg="\/api\/work\/\d+\s"

Re: Search an endpoint ending with numbers

newtosplunk14 — Fri, 06 Aug 2021 09:16:46 GMT

Thanks for your response Venkatasri. I tried but still returns all the events. I want the query to return one the first event in my log below.

my log is as below.

msg: timestamp="2021-08-06T08:55:56.091Z", local_host="3deb5c54-c5f9-446d-6136-89ee", status="200", remote_host="70.132.29.36", client_id="7012430", subject_id="NO_SUBJECT_ID", service_access_id="ACCESS_USER", billing_event_sent="false", execution_time="3", uri="/api/work/16898540", app_env="prod", usage_log="preval"

Re: Search an endpoint ending with numbers

ITWhisperer — Fri, 06 Aug 2021 09:21:45 GMT

cf_app_name="preval" cf_space_name="prod" | regex "uri=\"\/api\/work\/\d+\""

Re: Search an endpoint ending with numbers

venkatasri — Fri, 06 Aug 2021 09:22:07 GMT

@newtosplunk14 try this

cf_app_name="preval" cf_space_name="prod" | regex uri="\/api\/work\/\d+$"

Re: Search an endpoint ending with numbers

newtosplunk14 — Fri, 06 Aug 2021 12:56:08 GMT

Thanks heaps @venkatasri and @ITWhisperer . both your solutions worked brilliantly!