topic Re: need help with rex to extract responseMessage as ==> Declined - Do not Honor so that I can stats count by rspCode and respMesage with detail in Splunk Search

need help with rex to extract responseMessage as ==> Declined - Do not Honor so that I can stats count by rspCode and respMesage with detail

harishnpandey — Wed, 30 Sep 2020 03:17:42 GMT

2019-12-03 17:31:27.633 INFO ,aabbe872bbf3f848,aabbe872bbf3f848,false] 15 --- [nio-8080-exec-5] c.u.f.p.api.impl.: InfoLogging Operation=MakePayment, RequestSourceCode=ZBL, PaymentResponse=class PaymentResponse { responseCode: AB0000 responseMessage: Declined - Do not Honor orderId: 269107641 }

This is just n example . With the rex query I want to list all codes with respMessage

Below rex Query gets me respCode and respMessage part as only "Declined"

rex field=msg "responseCode: (?.[a-z0-9A-Z_-]+)"| rex field=msg "responseMessage: (?.[a-z0-9A-Z_-]+)

Re: need help with rex to extract responseMessage as ==> Declined - Do not Honor so that I can stats count by rspCode and respMesage with detail

richgalloway — Mon, 09 Dec 2019 20:56:26 GMT

Assuming responseMessage is always followed by orderId, this should work.

rex field=msg "responseCode: (?.[a-z0-9A-Z_-]+)"| rex field=msg "responseMessage: (?.[a-z0-9A-Z_-]+) orderId"

Re: need help with rex to extract responseMessage as ==> Declined - Do not Honor so that I can stats count by rspCode and respMesage with detail

dindu — Mon, 09 Dec 2019 21:13:27 GMT

Hey Harish,

Assuming you want everything in between responseMessage and orderId.
You could use the below SPL.
Replace your query in the line before the rex command.
Please try and let us know

        |makeresults
        |eval _raw ="2019-12-03 17:31:27.633 INFO ,aabbe872bbf3f848,aabbe872bbf3f848,false] 15 --- [nio-8080-exec-5] c.u.f.p.api.impl.: InfoLogging Operation=MakePayment, RequestSourceCode=ZBL, PaymentResponse=class PaymentResponse { responseCode: AB0000 responseMessage: Declined - Do not Honor orderId: 269107641 }"
        |rex field=_raw "responseMessage:(?P<response_message>.+)orderId"
        | table response_message

Re: need help with rex to extract responseMessage as ==> Declined - Do not Honor so that I can stats count by rspCode and respMesage with detail

to4kawa — Sun, 26 Jan 2020 00:54:15 GMT

| makeresults 
| eval _raw ="2019-12-03 17:31:27.633 INFO ,aabbe872bbf3f848,aabbe872bbf3f848,false] 15 --- [nio-8080-exec-5] c.u.f.p.api.impl.: InfoLogging Operation=MakePayment, RequestSourceCode=ZBL, PaymentResponse=class PaymentResponse { responseCode: AB0000 responseMessage: Declined - Do not Honor orderId: 269107641 }"
| rex mode=sed "s/(\w+): (.+?)(?= \w+\:| })/\"\1\": \"\2\",/g"
| rex "(?<json>\{.+\})"
| spath input=json

make JSON by force.