Getting Data In

identifying the user and the data submitted by the user via the rest api


i would like to report on the events submitted via the rest API by user. i have multiple users that submit data to splunk via the rest api. the request is recorded in _internal index as: - user1 [16/May/2013:12:55:00.807 -0600] "POST /services/receivers/simple?source=fetest&sourcetype=fexml&index=fe HTTP/1.1" 200 882 - - - 3ms

an example event may look like this:

<?xml version="1.0" encoding="utf-8"?><alerts appliance="" msg="normal" product="Web MPS" version="" xmlns="" xmlns:xsi="" xsi:schemaLocation=" FireEyeAlert.xsd"><alert id="91" name="malware-object" severity="majr"><explanation analysis="content" protocol="tcp"><malware-detected><malware name="Trojan.Onlinegames" origid="2274" sid="2274" stype="duplicate-md5sum" type="exe"><downloaded-at>2012-07-23T08:30:39.062949</downloaded-at><md5sum>5352ffa20a29a2201074dcafccb0c9d2</md5sum><original>cao.exe</original><http-header>GET /cao/cao.exe HTTP/1.0
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; InfoPath.2)
Accept: */*
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Length: 11539
Content-Type: application/octet-stream

i would like to find out the event corresponding to a submission and be able to present a table or be able to write an alert based on a combination of user and data in the submission.

i appreciate your insights.

Tags (3)
0 Karma

Re: identifying the user and the data submitted by the user via the rest api


this search seems to do the trick

index=blah | bucket time span=1s | join _time [search index=internal /services/receivers/simple? source=*/splunkd_access.log | bucket _time span=1s] | table user _raw

i used the bucket command so i can drop off milliseconds. one of the data sources has milliseconds and the other one doesn't.

View solution in original post

0 Karma