Splunk Enterprise

How do you graph HTTP methods?

marcrsplunk
New Member

Given a log with this format, how do you graph HTTP methods?

Apr 10 13:21:19 ip-10-245-220-105 de0df3ba02a9[1256]: {"userId":"[REDACTED]","url":"/this/is/the/url","headers":{"host":"host.elb.amazonaws.com","accept":"application/my_application+json","referer":"https://send_referral/"},"requestId":"RequestID","oktaId":"oktaID","method":"GET","queryParams":{},"level":"info","message":"api-request","label":"qpp-cmswi-api-prod","timestamp":"2020-04-10T17:21:19.763"}

That is a graph of PUT, POST, DELETE, PATCH, and GET operations.

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This may get you started. You may need to change the number of backslashes.

index=foo | rex "\"method\":\"(?<httpMethod>\w+)" | timechart span=1h count by httpMethod
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This may get you started. You may need to change the number of backslashes.

index=foo | rex "\"method\":\"(?<httpMethod>\w+)" | timechart span=1h count by httpMethod
---
If this reply helps you, an upvote would be appreciated.
0 Karma

marcrsplunk
New Member

That worked a treat, thanks!

I added usenull=f at the end. There is another log getting put in the stream with a different format, which created a lot of NULL values.

Thanks again!

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...