name: Splunk Stream HTTP
id: b12f601c-7f66-4d31-ab3c-a9ab03a597d5
author: Patrick Bareiss, Splunk
source: stream
sourcetype: stream:http
supported_TA:
  name: Splunk App for Stream
  version: 8.1.1
  url: https://splunkbase.splunk.com/app/1809
event_names: []
fields:
  - _time
  - bytes
  - bytes_in
  - bytes_out
  - cookie
  - date_hour
  - date_mday
  - date_minute
  - date_month
  - date_second
  - date_wday
  - date_year
  - date_zone
  - dest_ip
  - dest_mac
  - dest_port
  - endtime
  - flow_id
  - form_data
  - host
  - http_comment
  - http_content_length
  - http_content_type
  - http_method
  - http_user_agent
  - index
  - linecount
  - protocol_stack
  - punct
  - request
  - server
  - site
  - source
  - sourcetype
  - splunk_server
  - src_ip
  - src_mac
  - src_port
  - status
  - time_taken
  - timeendpos
  - timestamp
  - timestartpos
  - transport
  - uri_path
example_log:
  '{"endtime":"2021-04-21T08:12:01.084527Z","timestamp":"2021-04-21T08:12:01.082573Z","bytes":1674,"bytes_in":914,"bytes_out":760,"cookie":"session_id_8000=81beacd6cc82670cf51f101406b6f2e6dc00c023;
  splunkweb_csrf_token_8000=13513429838815417873; splunkd_8000=K_rZQa3n41JuL47HXxuyhPs6Uyg8ERiczX9k1NeOAcgeh5ujYRYXTZsScYZFpzbKV4a8q62CvlhCbXYeAHI6vhsEyaR4vE9Rzdq7Mt25A4QrsqooUEcqB_u5bptLgvpr^z1FCN","dest_ip":"10.0.1.12","dest_mac":"02:DA:73:7B:81:70","dest_port":8000,"flow_id":"b18ec342-0a3b-4fb6-b91e-a7b576687fd7","form_data":"output_mode=json&action=touch","http_comment":"HTTP/1.1
  200 OK","http_content_length":59,"http_content_type":"application/json; charset=UTF-8","http_method":"POST","http_user_agent":"Mozilla/5.0
  (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.128
  Safari/537.36","protocol_stack":"ip:tcp:http","request":"POST /en-GB/splunkd/__raw/servicesNS/nobody/search/search/jobs/1618989993.8/control
  HTTP/1.1","server":"Splunkd","site":"18.193.215.146:8000","src_ip":"46.128.24.64","src_mac":"02:AC:9D:85:B5:68","src_port":50021,"status":200,"time_taken":1954,"transport":"tcp","uri_path":"/en-GB/splunkd/__raw/servicesNS/nobody/search/search/jobs/1618989993.8/control"}'