Splunk Search

Search an endpoint ending with numbers

newtosplunk14
Explorer

I want to search for endpoints  /api/work/12345678 i.e api/work/(8 digt number). My below query gives me all the three endpoint in the logs. I just only want the ones that are  /api/work/12345678. 

Search Query - cf_app_name="preval" cf_space_name="prod" msg="*/api/jobs/*" 

My logs contain

msgabc - [2021-08-06T06:49:11.529+0000] "GET /api/work/12345678/data HTTP/1.1" 200 0 407 "-" "Java/1.8.0_222"

msgabc - [2021-08-06T06:49:11.529+0000] "GET /api/work/12345678 HTTP/1.1"  200 0 407 "-" "Java/1.8.0_222"

msgabc - [2021-08-06T06:49:11.529+0000] "GET /api/work/12345678/photo HTTP/1.1" 200 0 407 "-" "Java/1.8.0_222"

Thanks

Labels (1)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

@newtosplunk14  try this

cf_app_name="preval" cf_space_name="prod" | regex uri="\/api\/work\/\d+$"

View solution in original post

newtosplunk14
Explorer

Thanks heaps @venkatasri  and @ITWhisperer . both your solutions worked brilliantly!

0 Karma

newtosplunk14
Explorer

Thanks for your response Venkatasri. I tried but still returns all the events. I want the query to return one the first event in my log below.

my log is as below. 

msg: timestamp="2021-08-06T08:55:56.091Z", local_host="3deb5c54-c5f9-446d-6136-89ee", status="200", remote_host="70.132.29.36", client_id="7012430", subject_id="NO_SUBJECT_ID", service_access_id="ACCESS_USER", billing_event_sent="false", execution_time="3", uri="/api/work/16898540", app_env="prod", usage_log="preval"

msg: timestamp="2021-08-06T08:55:56.091Z", local_host="3deb5c54-c5f9-446d-6136-89ee", status="200", remote_host="70.132.29.36", client_id="7012430", subject_id="NO_SUBJECT_ID", service_access_id="ACCESS_USER", billing_event_sent="false", execution_time="3", uri="/api/work/16898540/data", app_env="prod", usage_log="preval"

0 Karma

venkatasri
SplunkTrust
SplunkTrust

@newtosplunk14  try this

cf_app_name="preval" cf_space_name="prod" | regex uri="\/api\/work\/\d+$"

ITWhisperer
SplunkTrust
SplunkTrust
cf_app_name="preval" cf_space_name="prod" | regex "uri=\"\/api\/work\/\d+\""
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If msg is a field which is already extracted, you can use this - note the \s in the pattern to terminate the URI

cf_app_name="preval" cf_space_name="prod" | regex msg="\/api\/work\/\d+\s"

venkatasri
SplunkTrust
SplunkTrust

Hi @newtosplunk14 

Try this,

cf_app_name="preval" cf_space_name="prod" | regex "\/api\/work\/\d+"

--

An upvote would be appreciated and Accept solution if this reply helps! 

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...