Splunk Enterprise

How do you graph HTTP methods?

marcrsplunk
New Member

Given a log with this format, how do you graph HTTP methods?

Apr 10 13:21:19 ip-10-245-220-105 de0df3ba02a9[1256]: {"userId":"[REDACTED]","url":"/this/is/the/url","headers":{"host":"host.elb.amazonaws.com","accept":"application/my_application+json","referer":"https://send_referral/"},"requestId":"RequestID","oktaId":"oktaID","method":"GET","queryParams":{},"level":"info","message":"api-request","label":"qpp-cmswi-api-prod","timestamp":"2020-04-10T17:21:19.763"}

That is a graph of PUT, POST, DELETE, PATCH, and GET operations.

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This may get you started. You may need to change the number of backslashes.

index=foo | rex "\"method\":\"(?<httpMethod>\w+)" | timechart span=1h count by httpMethod
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This may get you started. You may need to change the number of backslashes.

index=foo | rex "\"method\":\"(?<httpMethod>\w+)" | timechart span=1h count by httpMethod
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

marcrsplunk
New Member

That worked a treat, thanks!

I added usenull=f at the end. There is another log getting put in the stream with a different format, which created a lot of NULL values.

Thanks again!

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!