Display transaction_id, Amount and Grand total of amount.

[sandeepmakkena]

[2019-07-19 10:13:49,210] package=com.ABCDpay,class=PostingServices,service=ProcessAccountingInstruction,component=CBIS,category=business,code="11001",message="Accounting entry posted to core system - SUCCESS",serviceCallUUID="97f5cb97-2bbb-46e1-a6ed-392b2db7fc24",eventDateTime="2019-07-19T14:13:49.210Z",severity="INFO",eventCode="CBIS_11001",eventName="POSTING:SUCCEEDED",entityType="ACCOUNTING_ENTRY",entityId="Fine_B/TID220000063/1/2",accountIdType="BBAN",Id="01234",supplementaryData="{externalReferenceId='24200145',actualDestination='12345678',master='8764433222',originalDestination='0987654321',entryAmount='USD100.00',debitOrCredit='C',valueDate='2019-07-19T00:00:00.000Z',postingDate='2019-07-19T04:00:00.000Z',coreReferenceId='445445',businessReversalFlag=false,duplicateDetectedFlag=false}"

TID220000063 is transaction_id and USD100.00 is the Amount.

I want to display like
Transaction Amount
TID220000063 USD100.00
.
.
.
.
Total Sum(Amount)
I am able to extract TID but, not Amount field and have no idea how to handle currency in sum.
Thanks for your time.

[rbechtold]

Hey Sandeepmakkena,

I've used the sample data you provided to try explain how you can accomplish this. Copy and paste this into a Splunk instance:

| makeresults count=2
| eval _raw = "[2019-07-19 10:13:49,210] package=com.ABCDpay,class=PostingServices,service=ProcessAccountingInstruction,component=CBIS,category=business,code=\"11001\",message=\"Accounting entry posted to core system - SUCCESS\",serviceCallUUID=\"97f5cb97-2bbb-46e1-a6ed-392b2db7fc24\",eventDateTime=\"2019-07-19T14:13:49.210Z\",severity=\"INFO\",eventCode=\"CBIS_11001\",eventName=\"POSTING:SUCCEEDED\",entityType=\"ACCOUNTING_ENTRY\",entityId=\"Fine_B/TID220000063/1/2\",accountIdType=\"BBAN\",Id=\"01234\",supplementaryData=\"{externalReferenceId='24200145',actualDestination='12345678',master='8764433222',originalDestination='0987654321',entryAmount='USD100.00',debitOrCredit='C',valueDate='2019-07-19T00:00:00.000Z',postingDate='2019-07-19T04:00:00.000Z',coreReferenceId='445445',businessReversalFlag=false,duplicateDetectedFlag=false}\""
| table _time _raw
| kv
| rex field=entryAmount "\'USD(?<Amount>[^\']+)"
| rex field=entityId "\/(?<Transaction>TID[^\/]+)"
| table _time Transaction Amount
| addcoltotals labelfield=_time label=Total Amount

I've used to kv command to extract your fields. This should make working with them easier! In order to work with currency, you'll need to remove the "USD" portion from your data. After that, you should be able to work with the values like normal numbers. The addcoltotals command will add up all the numbers in the "Amount" fields, and give you a total.

I hope this is what you were trying to accomplish! If it isn't, or if you run into problems, let me know and I'll try to help.