Splunk 101
Filter API paths I have the following events which contain API request paths like the following, PUT /api/v1/apps/{id} PUT /api/v1/apps/{id}/users PUT /api/v1/apps/{id}/verify/{vid} and so on. I want only those events with the first pattern above, ie. PUT /api/v1/apps/{id} and want to discard the rest of the events. The splunk expression to use for this is, requestPath=/api/v1/apps/* PUT | regex requestPath="/api/v1/apps/([a-zA-Z0-9?]+)$" According to the splunk docs, use the regex command to filter out events, and Use the rex command to either extract fields using regular expression named groups, or replace or substitute characters in a field using sed expressions. Notes requestPath is a field available in the event, so we use it with the regex command. Using a fieldName is optional and if you don't use it, the regex uses the default _raw field, which is the whole event. Extract path variables from API path Example You have an API - GET /app/{appName}/{appId}/users, ...