Splunk Search

How to edit my search to discover endpoints not being called?

vgaltes
Explorer

Hi, I'm trying to create a report of the endpoints of our API that are not being called. I know how to get a list of the endpoints that are being called, something like:

search ApiRequest
| rex field=_raw "Finished call to (?<endpoint>(GET|POST|PUT|DELETE) [^\s\?]+).*"
| stats values(endpoint)

but I don't know how to make a diff between a list of all the endpoints and that result.

Thanks!

0 Karma
1 Solution

somesoni2
Revered Legend

You would need maintain a list of endpoints somewhere/somehow and then use that result with current search to compare and see which are endpoints are being reported. One option could be to maintain a lookup table files which you generate at some interval, say daily, which contains list of all endpoints. They you compare that lookup data against your search like this:

search ApiRequest
 | rex field=_raw "Finished call to (?<endpoint>(GET|POST|PUT|DELETE) [^\s\?]+).*"
| stats count by endpoint | append [| inputlookup yourendpointlookup.csv | tabel endpoint | eval count=0] 
| stats max(count) as count by endpoint | where count=0

This should give you list of endpoints where there was no data in your search.

If you can't get a lookup table option done and assuming that all endpoints report at least once a week, you can try something like this (assuming your current search's time range is today, if not, then you need to adjust the relative_time function value accordingly)

search ApiRequest earliest=-7d 
| rex field=_raw "Finished call to (?<endpoint>(GET|POST|PUT|DELETE) [^\s\?]+).*"
| eval period=if(_time>=relative_time(now(),"@d"),2,1)
| stats max(Period) as period by endpoint | where period=1

View solution in original post

somesoni2
Revered Legend

You would need maintain a list of endpoints somewhere/somehow and then use that result with current search to compare and see which are endpoints are being reported. One option could be to maintain a lookup table files which you generate at some interval, say daily, which contains list of all endpoints. They you compare that lookup data against your search like this:

search ApiRequest
 | rex field=_raw "Finished call to (?<endpoint>(GET|POST|PUT|DELETE) [^\s\?]+).*"
| stats count by endpoint | append [| inputlookup yourendpointlookup.csv | tabel endpoint | eval count=0] 
| stats max(count) as count by endpoint | where count=0

This should give you list of endpoints where there was no data in your search.

If you can't get a lookup table option done and assuming that all endpoints report at least once a week, you can try something like this (assuming your current search's time range is today, if not, then you need to adjust the relative_time function value accordingly)

search ApiRequest earliest=-7d 
| rex field=_raw "Finished call to (?<endpoint>(GET|POST|PUT|DELETE) [^\s\?]+).*"
| eval period=if(_time>=relative_time(now(),"@d"),2,1)
| stats max(Period) as period by endpoint | where period=1

vgaltes
Explorer

Awesome! Thank you very much!

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...