topic Re: How to extract a field in using regex? in Splunk Search

How to extract a field in using regex?

man03359 — Wed, 24 May 2023 16:30:39 GMT

I am relatively new to Splunk and I am trying to extracting fields in Splunk,

I have a pattern I am attempting to extract and put into a field. The pattern looks like this:

AdyenPaymentResponse::ProcessResponse::Response -> Result : Failure
AdyenPaymentResponse::ProcessResponse::Response -> Result : Success

I am using this expression to match the pattern:

| rex field=_raw "AdyenPaymentResponse:.*\sResult\s:(?<Status>)"

I have to keep "AdyenPaymentResponse" as the base search and I would like to extract this into a field called "Status" which shows only Failure or Success

Re: How to extract a field in using regex?

ITWhisperer — Wed, 24 May 2023 17:07:23 GMT

What is the question as this looks like it should work (although, depending on your data, you might want to use these slight modifications)

| rex field=_raw "AdyenPaymentResponse:.+\sResult\s:\s(?<Status>)"

Strictly speaking, you don't need field=_raw as this is the default field for rex

Re: How to extract a field in using regex?

man03359 — Wed, 24 May 2023 17:10:37 GMT

It is not creating a field, the regex I am using

Re: How to extract a field in using regex?

ITWhisperer — Wed, 24 May 2023 17:12:42 GMT

You are right, I missed it too. You need to specify the pattern you want to be in the field

| rex field=_raw "AdyenPaymentResponse:.+\sResult\s:\s(?<Status>.+)"

Re: How to extract a field in using regex?

man03359 — Wed, 24 May 2023 17:16:13 GMT

What should I modify exactly?

Re: How to extract a field in using regex?

ITWhisperer — Wed, 24 May 2023 17:19:03 GMT

Add the ".+" inside the brackets after <status>

Re: How to extract a field in using regex?

man03359 — Wed, 24 May 2023 17:24:06 GMT

Thanks a lot 🙂 It worked 🙂 🙂