Regex not workin

man03359 — Tue, 21 Nov 2023 11:17:13 GMT

Hi All,

Here is my how my event looks like -

20/11/2023 12:47:05 (01) >> AdyenProxy::AdyenPaymentResponse::ProcessPaymentFailure::Additional response -> Message : NotAllowed ; Refusal Reason : message=MessageHeader.POIID: NotAllowed Value: P400Plus-805598742, Reason: my POIID is P400Plus-805598450

I am trying to extract the part "POIID: NotAllowed Value: P400Plus-805598742, Reason: my POIID is P400Plus-805598450"

I am using this regex -

| rex field=_raw "MessageHeader.+(?<POIID_Error>)-*"

But the field vale POIID_Error seems to be blank after running the query.

Attaching the ss for reference.

Little suggestion to fix this is appreciated.

Re: Regex not workin

ITWhisperer — Tue, 21 Nov 2023 11:19:35 GMT

MessageHeader\.(?<POIID_Error>.+)

Re: Regex not workin

man03359 — Tue, 21 Nov 2023 11:22:09 GMT

@ITWhisperer

it seems to be working now , thanks a lot 🙂 🙂

topic Re: Regex not workin in Splunk Search

Regex not workin

Re: Regex not workin

Re: Regex not workin