Developing for Splunk Platform

Search payload sent with POST requests to a particular endpoint in the past

jcovingt
Engager

I have the following query, but I am not sure how to get the payload that was sent to the request_url.

index=fastly sourcetype=fastly_syslog_json fastly_service_name=www.mysite.com request_type=POST request_url="/api/v1/myPostEndpoint" | fields {what to put here?}

I am hoping there is a way I can inspect the payloads that have been POSTed to that endpoint over a range of time, in order to create a report on a particular field within those payloads.

0 Karma
1 Solution

jcovingt
Engager

It looks like request_body is not part of the normal http logs, which I suppose I should have known. Am I right in understanding that the only way I'd have captured this information is if I had been explicitly logging request_body at the app log level?

View solution in original post

0 Karma

jcovingt
Engager

It looks like request_body is not part of the normal http logs, which I suppose I should have known. Am I right in understanding that the only way I'd have captured this information is if I had been explicitly logging request_body at the app log level?

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...