topic Re: Need to exract amountTendered in Splunk Search

Need to exract amountTendered

yograjpatel — Tue, 29 Sep 2020 17:44:03 GMT

EWS Response Content:{_ "responseHeader" : {_ "success" : "true",_ "serviceName" : "payment",_ "resourceName" : "payments",_ "operationName" : "create",_ "version" : "1.25.261",_ "statementCode" : "001",_ "methodOfPaymentSequence" : "1",_ "amountTendered" : "705.14",_ "balanceBegin" : "1410.79",_ "balanceEnd" : "705.65",_ "icomsTransactionDateTime" : "20180116",_ "message" : {_ "code" : "PAYMENT_AUTH_SUCCESS",_ "message" : "Payment has been authorized."_ }_ } ]_}

Re: Need to exract amountTendered

horsefez — Tue, 16 Jan 2018 21:16:14 GMT

Hi,

how about a regular expression.

| rex field=_raw "amountTendered\"\s*\:\s*(?<amountTendered>[^\"]+)"

Re: Need to exract amountTendered

yograjpatel — Tue, 16 Jan 2018 21:39:01 GMT

I'm getting the total count but not the actual amount to sum up.

Re: Need to exract amountTendered

horsefez — Tue, 16 Jan 2018 21:51:00 GMT

Hi,

yeah. We have extracted a string value. You need to convert it into a number first.

Just do the following after the "rex" command:
| convert num(amountTendered)

https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Convert

Re: Need to exract amountTendered

yograjpatel — Tue, 16 Jan 2018 21:56:44 GMT

not working

Re: Need to exract amountTendered

yograjpatel — Tue, 16 Jan 2018 21:57:24 GMT

tried this too rex "\"amountTendered\"\s:\s\"(?P\d+)\""

Re: Need to exract amountTendered

horsefez — Tue, 16 Jan 2018 22:01:17 GMT

did you really do the following:

| rex field=_raw "amountTendered\"\s*\:\s*(?<amountTendered>[^\"]+)"
| convert num(amountTendered)

Re: Need to exract amountTendered

mayurr98 — Wed, 17 Jan 2018 06:19:30 GMT

hey @yograjpatel

Try this run anywhere search

| makeresults 
| eval _raw="EWS Response Content:{ \"responseHeader\" : { \"success\" : \"true\", \"serviceName\" : \"payment\", \"resourceName\" : \"payments\", \"operationName\" : \"create\", \"version\" : \"1.25.261\", \"statementCode\" : \"001\", \"methodOfPaymentSequence\" : \"1\", \"amountTendered\" : \"705.14\", \"balanceBegin\" : \"1410.79\", \"balanceEnd\" : \"705.65\", \"icomsTransactionDateTime\" : \"20180116\", \"message\" : { \"code\" : \"PAYMENT_AUTH_SUCCESS\", \"message\" : \"Payment has been authorized.\" } } ]}" 
| rex field=_raw "amountTendered\"\s:\s\"(?<amountTendered>[^\"]+)" 
| convert num(amountTendered)

In your environment, you should write

index=<your_index> 
| rex field=_raw "amountTendered\"\s:\s\"(?<amountTendered>[^\"]+)" 
| convert num(amountTendered)

Let me know if this helps !

Re: Need to exract amountTendered

yograjpatel — Wed, 17 Jan 2018 14:22:01 GMT

rex field=_raw "amountTendered\"\s:\s\"(?[^\"]+)" tried this and it worked

Re: Need to exract amountTendered

mayurr98 — Wed, 17 Jan 2018 14:32:21 GMT

Hey @yograjpatel
If you deem the posted answer is correct then pls accept/upvote to resolve this question.