Splunk Dev

Search payload sent with POST requests to a particular endpoint in the past

jcovingt
Engager

I have the following query, but I am not sure how to get the payload that was sent to the request_url.

index=fastly sourcetype=fastly_syslog_json fastly_service_name=www.mysite.com request_type=POST request_url="/api/v1/myPostEndpoint" | fields {what to put here?}

I am hoping there is a way I can inspect the payloads that have been POSTed to that endpoint over a range of time, in order to create a report on a particular field within those payloads.

0 Karma
1 Solution

jcovingt
Engager

It looks like request_body is not part of the normal http logs, which I suppose I should have known. Am I right in understanding that the only way I'd have captured this information is if I had been explicitly logging request_body at the app log level?

View solution in original post

0 Karma

jcovingt
Engager

It looks like request_body is not part of the normal http logs, which I suppose I should have known. Am I right in understanding that the only way I'd have captured this information is if I had been explicitly logging request_body at the app log level?

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...