Getting Data In

check conformance of header order

supradeepbokkas
New Member

Hello, am new to Splunk and this is my 1st post. I have logs that contain the request header information and need it to be in a particular order when the request is relayed to the server. How do I query and group logs by the order of header issued?

some example of headers expected "headers": {"host": "..", "accept-encoding": "..", "cache-control": "..", "referer": "..", "true-client-ip": "..", "user-agent": "..", "via": "..", "x-forwarded-for": "..", "x-forwarded-port": "443","x-forwarded-proto": "https", "connection": "keep-alive", "cookie": ".." }

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please describe your use case more. Who is relaying requests and to what server are they being relayed?

---
If this reply helps you, Karma would be appreciated.
0 Karma

supradeepbokkas
New Member

thanks @richgalloway, the use case is that we are expecting some edits to the header values by the CDN layer prior to issuing the request upstream (origin server). The edits get applied under some circumstances and when it does, the order of header changes. Wondering if there is a way to write a search query to groupby the order of headers received. Happy to clarify further.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Once you have the events parsed, you can process the fields in any order you choose. How you parse the events may have to change after the source changes how events are written. However, if you extract each field separately, without regard to it position in the event, then you be safe from future changes.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...