Getting Data In

How can we use the Splunk API better?

ddrillic
Ultra Champion

We ended up mapping api-splunk.<company>.com to a certain search head. Our concern with giving it to the users is the fact that the search head captain is not aware of searches that hit the api-splunk.<company>.com end point and also because users might abuse the access.

Any ideas?

For one thing, I would like to set an alert for certain users that use the API and ensure that they don’t pass a certain threshold in the number of searches they invoke via the API access. How can I find out these searches given the user name?

Tags (2)

efavreau
Motivator

Counting your title, you asked three questions. However, the question I can answer is how to find out API searches based on a user name.

I built the following search from this answer: https://answers.splunk.com/answers/116285/how-can-i-audit-users-who-are-connected-through-rest-api.h...

Try this to find API users (substituting WHODIS with the username of the person you want to search for):

index=_internal sourcetype=splunkd_access NOT ( user="splunk-system-user" OR user="-") NOT clientip="127.0.0.1" user=WHODIS 
| rex field=uri_path "search/jobs/(?<search_id>[^/\?]+)" 
| eval search_id="'"+coalesce(search_id,id)+"'"
###

If this reply helps you, an upvote would be appreciated.
0 Karma

maciep
Champion

do you have a load balancer in front of your shc? if so, is there a reason you don't load balance the api as well?

You may be able to tie the access logs to the audit logs but I'm not positive. Not sure if there is any sort of "this is an api" search in the logs or if you have to base it on connections to the management port?

ddrillic
Ultra Champion

Hi @maciep, we do have the load balancer in front of your shc. Not sure why the design is as such that the we hit only on sh for the api.

Interesting about the "this is an api" search...

0 Karma
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...