All Apps and Add-ons

Defining 1 field that appears 2 different ways for an old and new REST API?

boris
Path Finder

What is the best approach to defining a field (the user API key field) that in our logs appears in 2 different ways because we take different requests from both an old and a new REST interface?

The apiKey field exists in each REST API differently:

Request API Version 1:

 /2.0/APIKEY-GOES-HERE/query.json?param1=value1&param2=value2

Request API Version 2:

/query.json?apikey=APIKEY-GOES-HERE&param1=value1&param2=value2
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

You can simply either define two extractions, or a single extraction with an alternating regex. An extraction that fails will simply have no effect (other than the consume the resources of checking for the match).

e.g.:

EXTRACT-v1 = /2.0/(?<apikey>[^\/]*)/ from uri
EXTRACT-v2 = /query.json?apikey=(?<apikey>[^\=\&]*) from uri

The second extract could also be performed automatically by an appropriate KV extraction using DELIMS or KV_MODE.

View solution in original post

boris
Path Finder

Field aliases to normalize different field names

Source: http://docs.splunk.com/Documentation/Splunk/4.3.1/User/TagAndAliasFieldValues

Quote from docs:

"
Alias field names

You can add multiple aliases to a field name or use these field aliases to normalize different field names. This does not rename or remove the original field name. After you alias a field, you can search for it using any of its name aliases. To alias a field name, you need to have access to props.conf. For information on how to do this, see Create aliases for fields in the Knowledge Manager manual.
"

0 Karma

boris
Path Finder

For the novice: gkanapathy answer of using alternating regex refers to using "OR" with a '|' within the regex. See my below solution:

EXTRACT-v3 = (/2`\`.0/|apikey=)(?<apikey>[^\/]*)/
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

You can simply either define two extractions, or a single extraction with an alternating regex. An extraction that fails will simply have no effect (other than the consume the resources of checking for the match).

e.g.:

EXTRACT-v1 = /2.0/(?<apikey>[^\/]*)/ from uri
EXTRACT-v2 = /query.json?apikey=(?<apikey>[^\=\&]*) from uri

The second extract could also be performed automatically by an appropriate KV extraction using DELIMS or KV_MODE.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...