Search code examples
splunksplunk-query

Splunk query to fetch http methods

Here is my log message. I am trying to capture all the http methods that are coming to /selfservice url. Basically i want to find number of hits for each api with count for each GET, PUT, POST etc. 

65791 > GET http://self-qa-auto-1.stage.xyz.com/selfservice

There could be other urls similar(like below) but i want to capture selfservice only

23721 > POST http://self-qa-auto-1.stage.xyz.com/payservice

Here is the thing i tried

| rex field=message "\s+(?<httpmethod>\s+)http.*xyz.com\/selfservice"

tried different possibilities but did not get the correct data. any help appreciated.

Solution

  • i figured out and able to see the result

    | rex field=message ">\s+(?<httpmethod>\w*).*/selfservice"