Create endpoint rules to monitor related requests

Use endpoint rules to modify endpoints to align with your analytical needs, naming conventions, and cardinality requirements.

Endpoint rules modify and rename endpoints that start with, contain, or match a given string. You can create a default endpoint rule that affects all services and custom endpoint rules that affect specific services.

You can use endpoint rules to modify endpoints to align with your analytical needs, naming conventions, and cardinality requirements. Endpoint rules support more targeted analysis with endpoint-specific metrics and business transactions.

Endpoint rules are trace-level modifications that affect how endpoints appear across Splunk APM, such as in the trace view, Tag Spotlight, and the Endpoint tab in the service view. They also affect the business transactions that are generated if your business transaction rules are based on endpoints.

Use cases for endpoint rules

You can use endpoint rules to:

  • Group similar requests into a single endpoint.

  • Split an endpoint into multiple endpoints.

  • Dynamically rename grouped or split endpoints based on unique values in tags or URI segments. For example:

    • You want to split an api/checkout endpoint into multiple endpoints based on credit card types. This endpoint includes the cardType tag with values for visa, mastercard, and amex. You can create a rule to rename endpoints that match the api/checkout string based on the syntax api/checkout:<tag:cardType>. This rule splits the api/checkout endpoint into the following three endpoints: api/checkout:visa, api/checkout:mastercard, and api/checkout:amex.

    • You want to group the POST /api/v1/checkout and POST /api/v2/checkout endpoints into a single endpoint. You can create a rule to rename endpoints that contain the checkout string based on the syntax POST /<URIsegment1>/<URIsegment3>. This rule groups the two endpoints into a single endpoint named POST /api/checkout.

  • Create multiple endpoint rules for a service and control the priority that they are applied.

Create a default endpoint rule

Note:

You must have the admin role to configure endpoint rules.

The default endpoint rule affects all services. If the default rule and a custom rule affect the same service, the custom rule is given priority over the default rule.

To create a default endpoint rule:

  1. From the Splunk Observability Cloud main menu, select Settings > APM endpoint configuration.

  2. Under Default rule, select the row for the default rule.

  3. Follow the on-screen instructions to update the rule, then select Update rule.

  4. In the Status column, enable the toggle to activate the default rule.

Create a custom endpoint rule

Note:

You must have the admin role to configure endpoint rules.

A custom endpoint rule affects a specific service. If the default rule and a custom rule affect the same service, the custom rule is given priority over the default rule.

To create a custom endpoint rule:

  1. From the Splunk Observability Cloud main menu, select Settings > APM endpoint configuration.

  2. The Custom rules table lists services with existing custom endpoint rules.

    1. If the service doesn't have existing custom rules, select Create endpoint rule(s) for a service..

    2. If the service has existing custom rules, select the service from the table.

  3. Select Add rule. Follow the on-screen instructions to create the rule.

  4. If needed, adjust the priority of the new rule in the table. Rules are applied in the priority order defined in the table. By default, the newest rule has the highest priority.

  5. Select Save endpoint rules to create and apply the rule.

Next steps

After you create endpoint rules, you can: