Splunk Search

How to calculate Raw data for API endpoints and count?

mcscjlf
Explorer

I don't have a ton of experience with Splunk yet but I've been asked to find API endpoints (which appear to be in our raw data) and see how often their being used. 

 

Example Events:

| 2022-07-08 05:59:06 21.30.2.80 POST /api/transact/credit/sale 5051 - 571.232.505.62 okhttp/3.18.9

| 2022-07-08 05:02:01 22.35.3.79 POST /api/transact/device 6062 - 641.141.323.82 okhttp/2.15.3

 

What I want to end up with is the api and a count:

/api/transact/credit/sale        3,475

/api/transact/device                    275

 

Is this possible?

Thank you!!

Labels (3)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Assuming your apis are preceded by POST, try this

| rex "POST (?<api>\S+)"
| stats count by api

View solution in original post

0 Karma

mcscjlf
Explorer

This worked perfectly, thank you!!

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@mcscjlf - Try this:

| rex "\s+(?<ip>\d+\.\d+\.\d+\.\d+\s+)(?<http_method>\w+)\s+(?<endpoint>\S+)"
| stats count by endpoint

* I've extracted general fields here - IP, http_method, and endpoint with regex.

 

I hope this helps!!!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming your apis are preceded by POST, try this

| rex "POST (?<api>\S+)"
| stats count by api
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...