About mikeyty07

mikeyty07

i want to trace logs for specific api that runs in sequence for specific transsaction. like api/search/brand--> api/buy/gucci --> api/gucci/custom -->api/purchased. and these logs have one field in common TrackingID. Is there a way to get all these logs events in table for total count of the api searched for api/search/clothes and the TrackingID from the first api to the second api/buy/gucci total count and so on. 2023-05-11T15:06:14 TrackingID =abcdgucci123 duration=600 uri="/api/search/brand" source=xyz 2023-05-11T15:06:15 TrackingID =abcdgucci123 duration=500 uri="/api/buy/gucci" source=brb 2023-05-11T15:06:16 TrackingID =abcdgucci123 duration=500 uri="/api/gucci/custom" source=idk 2023-05-11T15:06:17 TrackingID =abcdgucci123 duration=500 uri="/api/purchased" source=abc this is just an example of logs there would be hunderds of these logs. Is there a way to get count of all api in table for the count of api called and so on through the TrackingID to the next api being called?

mikeyty07

I am planning to build a dashboard where all the extracted traceId # are collected and injected to another search criteria where only the extracted traceId # from 1st search is passed to 2nd search and have a results, total count for the 1st search and total count for second search only with those regex traceId. I used the drop down and used regex but when passing the token, I.m selecting all the traceId where it passes as * in second search which is searching all not from the 1st search. is there a way to inject the 1st searched traceId to 2nd search ?

mikeyty07 · ‎03-23-2023

if i have to add the duration in same query of rex what would it be?

mikeyty07 · ‎03-22-2023

can you help me how to write those eval % differences, i'm not quite sure if i got it correctly.

mikeyty07 · ‎03-22-2023

I have 2 kind of logs where there are two types of uri which i want to rex into different fields {logType=DOWNSTREAM_RESPONSE, requestUri=https://google.come.com:8000/google/api/updateapi?&lo=en_US&sc=RT, duration=22, requestId=znXdSxbJQw6iVTtEeykZVA, globalTrackingId=null, requestTrackingId=null, request={body={"a":{"b":{"country":"US", }}}, method=POST, requestUri=https://google.come.com:443/google/api/updateapi?&lo=en_US&sc=RT}, response=(200 OK, { "body="{} }, "headers="{}, "statusCode=OK", statusCodeValue=200}")"} {logType=DOWNSTREAM_RESPONSE, requestUri=https://google.come.com:8000/google/api/deleteapi, duration=33, requestId=asdasd, globalTrackingId=null, requestTrackingId=null, request={body={"a":{"b":{"country":"US", }}}, method=POST, requestUri=https://google.come.com:443/google/api/updateapi?&lo=en_US&sc=RT}, response=(200 OK, { "body="{} }, "headers="{}, "statusCode=OK", statusCodeValue=200}")"} http= https URL= google.come.com:8000 service = /google api= /api/updateapi api= /api/deleteapi params= ?&lo=en_US&sc=RT is there a way to regex this?

mikeyty07 · ‎03-22-2023

I have this working query which needs some additional detailing. index=_internal earliest=-1h@h latest=@h | lookup api uri OUTPUT operation service | rex "duration=(?<response_time>[^,]+)" | multikv | eval ReportKey="Today" | append [ search index=_internal earliest=-7d-1h@h latest=-7d@h | lookup api uri OUTPUT operation service | rex "duration=(?<response_time>[^,]+)" | multikv | eval ReportKey="lastweek" | eval _time=_time+604800] | stats first(uri) as apiName avg(response_time) as avgresponse_time count by operationName ReportKey Is there a way to get like this where it will compare all average response time and then give the percentile differences. operation uri today_avg (response_time) lastweek_avg (response_time) % differrences avg(response_time) today count last week count abc /api/abc 222 333 12312 42343 xyz /api/xyz 867 4234 87978 67867

mikeyty07 · ‎03-21-2023

is there a way to alert an email if today's hourly stats are 25% higher than the previous week same day hourly stats?

mikeyty07 · ‎02-17-2023

How do i compare for todays let say 9a-10a with yesterdays 9a-10a stats side by side? Is it possible on 1 qeury? index=foo <query> | stats avg(responsetime) today and tomorrow count by uri

mikeyty07 · ‎12-21-2022

I am trying to search with specific date and time. Is it possible to search and compare? for example, i want to get stats from 2022-12-20 14:00:00 to 2022-12-20 15:00:00 and compare it with other dates like 12/16, 12/10/, 12/5 with same time range. is there a way to get stats compared side by side with other dates OR just have the all mentioned dates and time (2p-3p) there in search query ?

mikeyty07 · ‎12-17-2022

The rex search query is good which I can get the fields. Its the same field i am trying to match so it can produce all the results for one api. this is an example from my csv file. serviceName uri_path http_method apiName /google /page1/page1a/*/googlep1 post postusingRRR /google /page1/page1a/sada/*/googlep1 get getusingep2 /google /pag5/ggg/*/ooopp/ggplr delete deleteusing the /*/ value changes in logs so I'm using the apiName to connect. In real the api looks like this /google/page1/page1a/{pageNumber}/googlep1 Only issue is with the lookup. How do i use the wildcard on this?

mikeyty07 · ‎12-16-2022

I am using rex field to extract the field name and then inject the data so I can get only the desired fields but not able to do so. My Access logs: server - - [date& time] "GET /google/page1/page1a/633243463476/googlep1 HTTP/1.1" 200 350 85 My search query: <query> | rex field_=(?<SRC>\d+\.\d+\.\d+\.\d+).+\]\s\"(?<http_method>\w+)\s(?<serviceName>/[^/]+)(?<uri_path>[^?\s]+)\s(?<uri_query>\S+)\"\s(?<statusCode>\d+)\s(?<body_size>\d+)\s\s(?<response_time>\d+) My Search query with lookup <query> | rex field=_raw "(?<SRC>\d+\.\d+\.\d+\.\d+).+\]\s\"(?<http_method>\w+)\s(?<serviceName>/[^/]+)(?<uri_path>[^?\s]+)\s(?<uri_query>\S+)\"\s(?<statusCode>\d+)\s(?<body_size>\d+)\s\s(?<response_time>\d+)" |search serviceName="/google" | lookup abc.csv uri_path OUTPUT serviceName apiName | search searviceName=* operationName=* I am using above query to lookup from csv file but I get all the api has same count and not able to get the stats or logs for only particular. Is there a way to match this and produce result with both uri_path and api_name? can anyone please help me on this? Eg: csv file looks like this and i am trying to match apiName and uri_path so the logs are getting properly. serviceName uri_path http_method apiName /google /page1/page1a/*/googlep1 post postusingRRR /google /page1/page1a/sada/*/googlep1 get getusingep2 /google /pag5/ggg/*/ooopp/ggplr delete deleteusing

mikeyty07 · ‎12-15-2022

Yes. For example, I've data like this in csv file. The numbers are different each time so I am using this unique apiName field to gather how much of calls are going to particular api. with this search query i am able to see the apiName but when i select only one apiName it stills shows different other uri_path as well <my search query> | rex field=_raw "(?<SRC>\d+\.\d+\.\d+\.\d+).+\]\s\"(?<http_method>\w+)\s(?<serviceName>/[^/]+)(?<uri_path>[^?\s]+)\s(?<uri_query>\S+)\"\s(?<statusCode>\d+)\s(?<body_size>\d+)\s\s(?<response_time>\d+)"| search serviceName="*" | lookup abc.csv serviceName OUTPUT uri_path apiName serviceName uri_path http_method apiName /google /page1/page1a/*/googlep1 post postusingRRR /google /page1/page1a/sada/*/googlep1 get getusingep2 /google /pag5/ggg/*/ooopp/ggplr delete deleteusing But the two query doesnt seem to work

mikeyty07 · ‎12-15-2022

Thank you worked like a charm, however i used (?<uri_root>/[^/]+)(?<uri_path>[^?\s]+)\s(?<uri_query>\S+) uri_query seemed to give results for Http/1.1 can you also please check this? It is follow up question. https://community.splunk.com/t5/Splunk-Search/Using-lookup-command-after-rex-field/td-p/624450

mikeyty07 · ‎12-15-2022

My Access logs: server - - [date& time] "GET /google/page1/page1a/633243463476/googlep1 HTTP/1.1" 200 350 85 rex query: (?<SRC>\d+\.\d+\.\d+\.\d+).+\]\s\"(?<http_method>\w+)\s(?<serviceName>/[^/]+)(?<uri_path>[^?\s]+)\s(?<uri_query>\S+)\"\s(?<statusCode>\d+)\s(?<body_size>\d+)\s\s(?<response_time>\d+) Search query with lookup *some query* | rex field=_raw "(?<SRC>\d+\.\d+\.\d+\.\d+).+\]\s\"(?<http_method>\w+)\s(?<serviceName>/[^/]+)(?<uri_path>[^?\s]+)\s(?<uri_query>\S+)\"\s(?<statusCode>\d+)\s(?<body_size>\d+)\s\s(?<response_time>\d+)" | lookup abc.csv uri_path OUTPUT serviceName apiName I am using above query to lookup from csv file but not getting any results. In this lookup file i have these fields. apiName is the unique name in this csv file which i am trying to link with the uri_path but not able to do so. Is there a way to match this and produce result with both uri_path and api_name? can anyone please help me on this? serviceName uri_path http_method apiName /google /page1/page1a/633243463476/googlep1 post postusingRRR

mikeyty07 · ‎12-15-2022

the search didnt give any results, also how do i get results of all the other companies like facebook, twitter?

mikeyty07 · ‎12-14-2022

I have an access logs which prints like this server - - [date& time] "GET /google/page1/page1a/633243463476/googlep1?sc=RT&lo=en_US HTTP/1.1" 200 350 85 which rex is | rex field=_raw "(?<SRC>\d+\.\d+\.\d+\.\d+).+\]\s\"(?<http_method>\w+)\s(?<uri_path>\S+)\s(?<uri_query>\S+)\"\s(?<statusCode>\d+)\s(?<body_size>\d+)\s\s(?<response_time>\d+)" Is there a way to seperate uri into two or 3? /google/page1/page1a/633243463476/googlep1?sc=RT&lo=en_US TO /google /page1/page1a/633243463476/googlep1?sc=RT&lo=en_US OR /google /page1/page1a/633243463476/googlep1 ?sc=RT&lo=en_US

mikeyty07 · ‎11-21-2022

I have a dashboard with dropdown select. From this dropdown, once I select a api "/api/apiresponse/search/" then in the search results it will show this 2000-1-1 1:0:0.00 INFO : logType=API_RESPONSE, duration=100, request={"headers":"Accept":"application/json","Content-Type":"application/json"},"method":"POST", "body":{"body"},"parameters":{},"uri":"/api/apiresponse/search/"}, configLabel=, requestId=Thisoneismatching11111, response={"headers":{"statusCode":"OK"}, requestUri=/api/apiresponse/search/, threadContextId=Thisoneismatching22222, message=COMPLETED request /api/apiresponse/search/, source = /apps/logs/api_response.log sourcetype = response_log this is my search query for API_response index=main *_RESPONSE | spath input=request | spath input=response | lookup abc.csv uri OUTPUT opName | search Name="$Nme$" opName="$opeNme$" uri="$apis$" Downstream response log 2000-1-1 1:0:0.00 INFO logType=DOWNSTREAM_RESPONSE, duration=100, request={"headers":{"Accept":"application/json","Content-Type":"application/json"},"method":"POST", "body":{"uri":"https://abcdefg.com/downresponseservice/api/downresponse"}, configLabel=, requestId=Thisoneismatching11111, response={"OK":{"statusCode":"OK"}}, requestUri=https://abcdefg.com/downresponseservice/api/downresponse, threadContextId=Thisoneismatching22222, message=<<< Outbound REST response, source = /apps/logs/downstream_response.log sourcetype = response_log same way Is there a way to get downstream response? All the Api logs and downstream logs has two matching field requestId andthreadContextId I would need from the selected api, it has to get api_response logs and downstream logs related to only that api.

mikeyty07 · ‎11-18-2022

yup i wanted to see the other logs but through the selected api from dropdown, and get the logs of api logs and downstream logs on two different panel. but this search query is missing that thing.

mikeyty07 · ‎11-16-2022

i tried but it didnt work, shows all the logs. Not sure how to achieve it but from the dashboard perspective i chose the api then based on that api it has downstream which i am still confused how am i supposed to get the downstream response only through selected api's and these requestId/threadcontextId are matched only on which are hidden in logs. i believe it has to be coded with js or sth.

mikeyty07 · ‎11-16-2022

Here is the sample logs for API_Response and Downstream_Response. Only two fields are matching in this logs. 2000-1-1 1:0:0.00 INFO : logType=API_RESPONSE, duration=100, request={"headers":"Accept":"application/json","Content-Type":"application/json"},"method":"POST", "body":{"body"},"parameters":{},"uri":"/api/apiresponse/search/"}, configLabel=, requestId=Thisoneismatching11111, response={"headers":{"statusCode":"OK"}, requestUri=/api/apiresponse/search/, threadContextId=Thisoneismatching22222, message=COMPLETED request /api/apiresponse/search/, source = /apps/logs/api_response.log sourcetype = response_log 2000-1-1 1:0:0.00 INFO logType=DOWNSTREAM_RESPONSE, duration=100, request={"headers":{"Accept":"application/json","Content-Type":"application/json"},"method":"POST", "body":{"uri":"https://abcdefg.com/downresponseservice/api/downresponse"}, configLabel=, requestId=Thisoneismatching11111, response={"OK":{"statusCode":"OK"}}, requestUri=https://abcdefg.com/downresponseservice/api/downresponse, threadContextId=Thisoneismatching22222, message=<<< Outbound REST response, source = /apps/logs/downstream_response.log sourcetype = response_log From my Dashboard I am using inputlookup and based on the api it should show result for downstream as well. here is the query i used for my dropdown dashboard |inputlookup abc.csv| search Name="$Nme$" uri="$apis$" | dedup opName | table opName here is the search query, still not able to figure out index=main *_RESPONSE | spath input=request | spath input=response | lookup abc.csv uri OUTPUT opName | search Name="$Nme$" opName="$opeNme$" uri="$apis$"

Posts	42
Solutions	0
Karma Given	11
Karma Received	1
Member Since	‎03-22-2021

Online Status	Offline
Date Last Visited	2 weeks ago

How can I inject all rex field events from 1st sea...

How to rex?

How to compare today hourly stats and previous wee...

How do I compare for todays and yesterdays stats/ ...

How to search by specific date and time range and ...

How to use rex to create a field and using lookup ...

Is there a way to match this and produce result wi...

Is there a way to use rex to divide api name?

Is there a way to show the data of api_response an...

Is there a way to show the data of api_response co...

Re: injecting all rex field events from 1st search...

How can I inject all rex field events from 1st sea...

Re: how to rex

Re: compare today hourly stats and previous week s...

How to rex?

Re: compare today hourly stats and previous week s...

How to compare today hourly stats and previous wee...

How do I compare for todays and yesterdays stats/ ...

How to search by specific date and time range and ...

Re: Using rex to create a field and using lookup t...

How to use rex to create a field and using lookup ...

Re: Using lookup command after rex field?

Re: Is there a way to use rex to divide api name?

Is there a way to match this and produce result wi...

Re: Is there a way to use rex to divide api name?

Is there a way to use rex to divide api name?

Is there a way to show the data of api_response an...

Re: Is there a way to show the data of api_respons...

Re: Is there a way to show the data of api_respons...

Re: Is there a way to show the data of api_respons...