topic Field extraction in Splunk Search

Field extraction

sandeepmakkena — Fri, 13 Sep 2019 19:29:35 GMT

gauge="ProcessorResponse.Country[US]Processor[ApgProcessor]PaymentType[VISA] DECLINE" is one of the field.
I am trying to get Country, Processor, PaymentType and reason fields.

my search
| rex "Country[(?[^]]+)]Processor[(?[^]]+)]PaymentType[(?[^]]+)] (?[^"]+)"

I am using this but its not working, can someone help please.

Thanks for your time.

Re: Field extraction

adonio — Sat, 14 Sep 2019 02:24:34 GMT

try this:

| makeresults count=1
| eval gauge="\"ProcessorResponse.Country[US]Processor[ApgProcessor]PaymentType[VISA] DECLINE\""
| rex field=gauge "\.Country\[(?<country>[^\]]+)\]Processor\[(?<processor>[^\]]+)\]PaymentType\[(?<payment_type>[^\]]+)\]\s+(?<result>[^\"]+)"

hope it helps

Re: Field extraction

vinod94 — Sat, 14 Sep 2019 19:31:53 GMT

Hi dyude @sandeepmakkena ,

You can try this ,

index=your index
|rex field=gauge "ProcessorResponse\.Country\[(?P<Country>.+)\]Processor\[(?P<Processor>.+)\]PaymentType\[(?P<PaymentType>.+)\]\s(?P<reason>\w+)"

Re: Field extraction

sandeepmakkena — Sun, 15 Sep 2019 17:17:37 GMT

Thank you.