Web
The fields in the Web data model describe web server and/or proxy server data in a security or operational context.
Note: A dataset is a component of a data model. In versions of the Splunk platform prior to version 6.5.0, these were referred to as data model objects.
Tags used with the Web event datasets
The following tags act as constraints to identify your events as being relevant to this data model. For more information, see How to use these reference tables.
Dataset name | Tag name |
---|---|
Web | web |
|
proxy |
Fields for Web event datasets
The following table lists the extracted and calculated fields for the event datasets in the model. Note that it does not include any inherited fields. For more information, see How to use these reference tables.
Dataset name | Field name | Data type | Description | Abbreviated list of example values |
---|---|---|---|---|
Web | action
|
string | The action taken by the server or proxy. | |
Web | app
|
string | The application detected or hosted by the server/site such as WordPress, Splunk, or Facebook. | |
Web | bytes
|
number | The total number of bytes transferred (bytes_in + bytes_out ).
|
|
Web | bytes_in
|
number | The number of inbound bytes transferred. | |
Web | bytes_out
|
number | The number of outbound bytes transferred. | |
Web | cached
|
boolean | Indicates whether the event data is cached or not. | true , false , 1 , 0
|
Web | category
|
string | The category of traffic, such as may be provided by a proxy server. | |
Web | cookie
|
string | The cookie file recorded in the event. | |
Web | dest
|
string | The destination of the network traffic (the remote host). You can alias this from more specific fields, such as dest_host , dest_ip , or dest_name .
|
|
Web | dest_bunit
|
string | These fields are automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for these fields when writing add-ons. | |
Web | dest_category
|
string | ||
Web | dest_port
|
number | ||
Web | dest_priority
|
string | ||
Web | duration
|
number | The time taken by the proxy event, in milliseconds. | |
Web | http_content_type
|
string | The content-type of the requested HTTP resource. | |
Web | http_method
|
string | The HTTP method used in the request. | Prescribed fields:GET , PUT ,POST , HEAD
Other: |
Web | http_referrer
|
string | The HTTP referrer used in the request. The W3C specification and many implementations misspell this as http_referer . Use a FIELDALIAS to handle both key names.
|
|
Web | http_user_agent
|
string | The user agent used in the request. | |
Web | http_user_agent_length
|
number | The length of the user agent used in the request. | |
Web | response_time
|
number | The amount of time it took to receive a response, if applicable, in milliseconds. | |
Web | site
|
string | The virtual site which services the request, if applicable. | |
Web | src
|
string | The source of the network traffic (the client requesting the connection). | |
Web | src_bunit
|
string | These fields are automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for these fields when writing add-ons. | |
Web | src_category
|
string | ||
Web | src_priority
|
string | ||
Web | status
|
string | The HTTP response code indicating the status of the proxy request. | 100 , 101 , 102 , 200 , 201 , 202 , 203 , 204 , 205 , 206 , 207 , 208 , 226 , 300 , 301 , 302 , 303 , 304 , 305 , 306 , 307 , 308 , 400 , 401 , 402 , 403 , 404 , 405 , 406 , 407 , 408 , 409 , 410 , 411 , 412 , 413 , 414 , 415 , 416 , 417 , 422 , 423 , 424 , 426 , 428 , 429 , 431 , 500 , 501 , 502 , 503 , 504 , 505 , 506 , 507 , 508 , 510 , 511
|
Web | tag
|
string | This automatically generated field is used to access tags from within datamodels. Do not define extractions for this field when writing add-ons. | |
Web | uri_path
|
string | The path of the resource served by the webserver or proxy, such as /CertEnroll/Blue%20Coat%20Systems
|
|
Web | uri_query
|
string | The path of the resource requested by the client, such as ?return_to=%2Fen-US%2Fapp%2Fsimple_xml_examples%2Fcustom_viz_
|
|
Web | url
|
string | The URL of the requested HTTP resource, such as http://0.channel36.facebook.com/x/1746719903/
false/p_1243021868=11
http://0.channel36.facebook.com/x/3833188787/
false/p_1243021868=11
http://0.channel37.facebook.com/x/3598566724/
false/p_576766886=1
http://01275269302.channel11.facebook.com/x/
832619022/false/p_792194432=2
http://03978257738.channel38.facebook.com/x/
3905575759/false/p_1576492095=0
http://1.gravatar.com/avatar/72f230f80
db7d667952d596cafbaf928?s=16&d=identicon&r=PG
http://10.0.26.105:8080/secars/secars.dll?h=3397A86
EC64FCE11F15337B7BE75CF1EF7443FFA8
E58454580830E8D41D695469C01E8D128BF891F4D
0438A70BE3E0A0D7BABD610DE3A588DF1804F823
CD509F0A2177AD97F7B9F3D09BEDA005C241B873
349D525C0264A9F1655FD408F70DD465574D5E8E
BE0DC29030A6365C1F025CB2954E2C38E0404CE4
D24970B2613EB394E2611FD7EC8EB2AD84318421CD
40DF01E6DF002AFF775653030012EF432D59072C0
5F1A939A6C1467CC3A129801587BE559CB16653513
3EAA6C78D3C4BDEC6D795C2934A176DACBB3839
8ED490322037DDB59101EE725138FF8534D89657F4
43F084ACE66DF159581AEF495F317536C34477D005
49B514A81CC689BFB7ACA7C10399C2C7BD76319876
C9890FB4172BBC7CBDF50F7CE0B164BE7F8D8228E9
555E39EE9D0F50B6CE3F610533544A959087F03FCD
16D8FDF0F9C5EB692E3C7EE61B75272961CC29A05D
5F3A1629BBF7C70044BBC65D30812B8EB3E0C7510C
DA0F636808B32925481602F702714C60ADC7040F58
CACA4BDD61D776C796D5344495B93AC08F16FC851E
3FB157CEBB563CC1
http://10.10.8.60/
http://10.120.109.82/en-US/static/@255606:0/app/simple_
xml_examples/components/forcedirected/
forcedirected.js?_=1424960631242
http://10.120.251.250/en-US/account/login .
|
|
Web | url_length
|
number | The length of the URL. | |
Web | user
|
string | The user that requested the HTTP resource. | |
Web | user_bunit
|
string | These fields are automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for these fields when writing add-ons. | |
Web | user_category
|
string | ||
Web | user_priority
|
string | ||
Web | vendor_product
|
string | The vendor and product of the proxy server, such as Squid Proxy Server . This field can be automatically populated by vendor and product fields in your data.
|
Vulnerabilities | Approaches to using the CIM |
This documentation applies to the following versions of Splunk® Common Information Model Add-on: 4.15.0
Feedback submitted, thanks!