How do you graph HTTP methods?

[marcrsplunk]

Given a log with this format, how do you graph HTTP methods?

Apr 10 13:21:19 ip-10-245-220-105 de0df3ba02a9[1256]: {"userId":"[REDACTED]","url":"/this/is/the/url","headers":{"host":"host.elb.amazonaws.com","accept":"application/my_application+json","referer":"https://send_referral/"},"requestId":"RequestID","oktaId":"oktaID","method":"GET","queryParams":{},"level":"info","message":"api-request","label":"qpp-cmswi-api-prod","timestamp":"2020-04-10T17:21:19.763"}

That is a graph of PUT, POST, DELETE, PATCH, and GET operations.

[richgalloway · Accepted solution]

This may get you started. You may need to change the number of backslashes.

index=foo | rex "\"method\":\"(?<httpMethod>\w+)" | timechart span=1h count by httpMethod

[marcrsplunk]

That worked a treat, thanks!

I added usenull=f at the end. There is another log getting put in the stream with a different format, which created a lot of NULL values.

Thanks again!