Sign in

v1

latestOpenAPI 3.0.02026-08-064311,0881.3 MB
dynamicParsingRuleManagement

Create a new dynamic parsing rule.

Create a new dynamic parsing rule.

post/v1/dynamicParsingRules

Request body

namestring required

Name of the dynamic parsing rule. Use a name that makes it easy to identify the rule.

scopestring required

Scope of the dynamic parsing rule. This could be a sourceCategory, sourceHost, or any other metadata that describes the data you want to extract from. Think of the Scope as the first portion of an ad hoc search, before the first pipe ( | ). You'll use the Scope to run a search against the rule.

enabledboolean required

Is the dynamic parsing rule enabled.

Example request

{
  "name": "DynamicParsingRule123",
  "scope": "_sourceHost=127.0.0.1"
}

Response

The dynamic parsing rule has been created.

namestring required

Name of the dynamic parsing rule. Use a name that makes it easy to identify the rule.

scopestring required

Scope of the dynamic parsing rule. This could be a sourceCategory, sourceHost, or any other metadata that describes the data you want to extract from. Think of the Scope as the first portion of an ad hoc search, before the first pipe ( | ). You'll use the Scope to run a search against the rule.

enabledboolean required

Is the dynamic parsing rule enabled.

createdAtstring dateTime required

Creation timestamp in UTC in RFC3339 format.

createdBystring required

Identifier of the user who created the resource.

modifiedAtstring dateTime required

Last modification timestamp in UTC.

modifiedBystring required

Identifier of the user who last modified the resource.

idstring required

Unique identifier for the dynamic parsing rule.

isSystemRuleboolean required

Whether the rule has been defined by the system, rather than by a user.

Example response

{
  "name": "DynamicParsingRule123",
  "scope": "_sourceHost=127.0.0.1",
  "id": "0000000001C41EE4"
}