Splunk query to fetch http methods

Question

Here is my log message. I am trying to capture all the http methods that are coming to /selfservice url. Basically i want to find number of hits for each api with count for each GET, PUT, POST etc.

65791 > GET http://self-qa-auto-1.stage.xyz.com/selfservice

There could be other urls similar(like below) but i want to capture selfservice only

23721 > POST http://self-qa-auto-1.stage.xyz.com/payservice

Here is the thing i tried

| rex field=message "\s+(?<httpmethod>\s+)http.*xyz.com\/selfservice"

tried different possibilities but did not get the correct data. any help appreciated.

score 0 · Accepted Answer · answered Dec 14 '17 at 23:00

0

i figured out and able to see the result

| rex field=message ">\s+(?<httpmethod>\w*).*/selfservice"

answered Dec 14 '17 at 23:00

Kiran

839
3
15
45

Splunk query to fetch http methods

1 Answers1