All Apps and Add-ons

Need a querry to triage an api on all possible hosts.

vikram_m
Path Finder

We have around 10 hosts with similar APIs i.e 20. something like below.

/api/v1/device/host1
/api/v1/device/host2
/api/v1/device/host3
/api/v1/device/host4
/api/v1/device/host5
/api/v1/device/host1/provisioning/
/api/v1/device/host2/provisioning/
/api/v1/device/host3/provisioning/
/api/v1/device/host5/provisioning/
/api/v1/device/host6/provisioning/
/api/v1/device/host7/provisioning/
/api/v1/device/host1/authentication
/api/v1/device/host2/authentication
/api/v1/device/host3/authentication
/api/v1/device/host3/authentication
/api/v1/device/host4/authentication
/api/v1/device/host5/authentication

based on these set of 20 apis and 10 devices I need a querry which can give me stats for the individual apis irrespective of devices something like below.

/api/v1/device//authentication/ 10
/api/v1/device/
/provisioning/ 20
/api/v1/device/* 12

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@vikram_m

You can use the regular expression for extracting devices and apis from URL and use stats command to get the desired output.

try this rex command for extracting.

| rex field=_raw "\/api\/v1\/device\/(?<device>[^\/]+)(\/(?<api>[^\/]+))?"

Then after you can use stats command.

like.

For distinct devices : | stats dc(device) as devices
For count by api: | stats count by api

Use this sample search:

|makeresults | eval _raw="
URL
/api/v1/device/host1
/api/v1/device/host2
/api/v1/device/host3
/api/v1/device/host4
/api/v1/device/host5
/api/v1/device/host1/provisioning/
/api/v1/device/host2/provisioning/
/api/v1/device/host3/provisioning/
/api/v1/device/host5/provisioning/
/api/v1/device/host6/provisioning/
/api/v1/device/host7/provisioning/
/api/v1/device/host1/authentication
/api/v1/device/host2/authentication
/api/v1/device/host3/authentication
/api/v1/device/host3/authentication
/api/v1/device/host4/authentication
/api/v1/device/host5/authentication
"| multikv | rex field=_raw "\/api\/v1\/device\/(?[^\/]+)(\/(?[^\/]+))?" | stats dc(device) as devices
0 Karma
Get Updates on the Splunk Community!

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco &#43; Splunk! We’ve ...

AI Adoption Hub Launch | Curated Resources to Get Started with AI in Splunk

Hey Splunk Practitioners and AI Enthusiasts! It’s no secret (or surprise) that AI is at the forefront of ...