Getting Data In

How do I capture unique API list my application is using through Splunk?

vijaydudipala88
New Member

I have paths like this:

https://100.100.100.100:8080/rest/config/L3UCPE-API:services/service-list/{uniqueId}/
https://100.100.100.100:8080/rest/config/L3UCPE-API:services/service-list/{uniqueId}/service-data/op...
https://100.100.100.100:8080/rest/config/L3UCPE-API:services/service-list/{uniqueId}/service-data/uc...

I tried:

index=abc sourcetype="audit" "|https://100.100.100.100:8080/rest/config/L3UCPE-API:services/service-list/*/|"

The wildcard * is capturing above three as single API, I need them as three separate ones. All help is appreciated.

Tags (2)
0 Karma

sduff_splunk
Splunk Employee
Splunk Employee
index=abc sourcetype="audit" | rex field=_raw "/service-list/(?<api>[^/]+)/" | stats count by api

The rex command will run a regular expression over the strings, grab the portion that follows /service-list/ and stores it in the field 'api'. The stats count command counts the frequency of each unique api, giving you the usage.

0 Karma

vijaydudipala88
New Member

The portion that follows "/service-list/" is unique id and is followed by "/service-data/oper-status/" ..........so I need count like this:
1. https://100.100.100.100:8080/rest/config/L3UCPE-API:services/service-list/{uniqueId}/service-data/op... ---1000
2. https://100.100.100.100:8080/rest/config/L3UCPE-API:services/service-list/{uniqueId}/service-data/uc... ----970
3. https://100.100.100.100:8080/rest/config/L3UCPE-API:services/service-list/{uniqueId}/ -----500

The 3rd APIs count should not include counts of 1st and 2nd though the path looks like superset of 1 and 2

0 Karma

sduff_splunk
Splunk Employee
Splunk Employee

So what you actually want to capture is everything up until the pipe | symbol. In this case, this is the regular expression
index=abc sourcetype="audit" | rex field=_raw "/service-list/(?[^|]+)|" | stats count by api

0 Karma

Richfez
SplunkTrust
SplunkTrust

You have these paths inside events?

Also, you have pipe characters inside your search - from that I assume you trimmed the events you are displaying here? Could you instead paste the full event - just pick one, obfuscating if necessary but please try to keep the structure the same?

0 Karma

vijaydudipala88
New Member

2017-05-12T14:44:40:995+00:00|2017-05-12T14:44:40:999+00:00|xaxaxabb-eb88-4b9a-xxxx-83xxxx38a6|v2.0/sites/site/mccfl/ports/port/xaxaxabb-eb88-4b9a-xsss-83xxdd38a6|1967149302-19938||https://100.100.100.100:8080/rest/config/L3UCPE-API:services/service-list/{uniqueId}/|admin|COMPLETE...

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...