Splunk Search

How to calculate Raw data for API endpoints and count?

mcscjlf
Explorer

I don't have a ton of experience with Splunk yet but I've been asked to find API endpoints (which appear to be in our raw data) and see how often their being used. 

 

Example Events:

| 2022-07-08 05:59:06 21.30.2.80 POST /api/transact/credit/sale 5051 - 571.232.505.62 okhttp/3.18.9

| 2022-07-08 05:02:01 22.35.3.79 POST /api/transact/device 6062 - 641.141.323.82 okhttp/2.15.3

 

What I want to end up with is the api and a count:

/api/transact/credit/sale        3,475

/api/transact/device                    275

 

Is this possible?

Thank you!!

Labels (3)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Assuming your apis are preceded by POST, try this

| rex "POST (?<api>\S+)"
| stats count by api

View solution in original post

0 Karma

mcscjlf
Explorer

This worked perfectly, thank you!!

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@mcscjlf - Try this:

| rex "\s+(?<ip>\d+\.\d+\.\d+\.\d+\s+)(?<http_method>\w+)\s+(?<endpoint>\S+)"
| stats count by endpoint

* I've extracted general fields here - IP, http_method, and endpoint with regex.

 

I hope this helps!!!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming your apis are preceded by POST, try this

| rex "POST (?<api>\S+)"
| stats count by api
0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...