Splunk Search

Eliminate the refund failure transactions using backup processor

iqbalintouch
Path Finder

Hi
In my app there are 2 payment processor, netconnect(backup) and sourcejet(primary), where is netconnect is the backup processor. I have created a report query which pulls the refund data from the logs given below

log: <myapp.com.sys.BillingLogger.logResponse(?:?):stage=final; type=payment; service=PaymentCollect; processor=netconnect; method=refund; itemType=F; status=failed; latency=602; payMode=Card; CardType=visa; bookingId=91113274385; error='Decline - Generic Error. No other information provided'>

The query used is as below:

stage=final type=payment processor=netconnect method=refund status=failed bookingId=* paymentMode=* | stats count by bookingId

Output:

bookingId

Count

91113274385

1

91111234567

1

91114567890

1

 

Now the issue here is in certain scenario system makes a retry using the backup net connect processor. This happens when the first call for refund to sourcejet failed due to a system error.

Netconnect log: <myapp.com.sys.BillingLogger.logResponse(?:?):stage=final; type=payment; service=PaymentCollect; processor=sourcejet; method=refund; itemType=F; status=failed; latency=602; payMode=Card; CardType=visa; bookingId=91113274385; error='Decline - Generic Error. No other information provided'>

Sourcejet log: <myapp.com.sys.BillingLogger.logResponse(?:?):stage=final; type=payment; service=PaymentCollect; processor=sourcejet; method=refund; itemType=F; status=failed; latency=602; payMode=Card; CardType=visa; bookingId=91113274385; error='Decline - Generic Error. No other information provided'>

If there is a way to eliminate the sourcejet failures using net connect for backup

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Are you saying if processor doesn't match source you want to discount it from the stats? If so, does the source field contain something that distinguishes which processor it came from? Alternatively, can you dedup bookingId to get only one event per bookingId? 

0 Karma

iqbalintouch
Path Finder

Hi @ITWhisperer ,
so, I need only those bookingId which are available here:

Netconnect log: <myapp.com.sys.BillingLogger.logResponse(?:?):stage=final; type=payment; service=PaymentCollect; processor=sourcejet; method=refund; itemType=F; status=failed; latency=602; payMode=Card; CardType=visa; bookingId=91113274385; error='Decline - Generic Error. No other information provided'>

and NOT here:

Sourcejet log: <myapp.com.sys.BillingLogger.logResponse(?:?):stage=final; type=payment; service=PaymentCollect; processor=sourcejet; method=refund; itemType=F; status=failed; latency=602; payMode=Card; CardType=visa; bookingId=91113274385; error='Decline - Generic Error. No other information provided'>


what it means is, the sourcejet processor is the primary processor for refund process and in case of any system error or network glitch; the app makes a retry using the backup processor(netconnnect).
Also, there are certain refund requests which gets processed through netconnect only and for such transactions/refunds there will be only one entry.

so, is there any way to fetch the bookingId's which are available in netconnect log only.

both the logs are identical except the except the processor field value, it would be either 'netconnect' or 'sourcejet'

let me know if you need more details.
thank you!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

IF you can't distinguish from the _raw event data which log the message has come from, you could use the meta-data that comes along with it. There are a couple of fields, index, sourcetype, and perhaps more relevantly host and source. Host usually contains the name of box where the file originated. Source usually contains the path of the file the events were ingested from. Depending on the values you have in these, you may be able to filter out the events you don't want. For example, if source contains "netconnect"

0 Karma

iqbalintouch
Path Finder

index, sourcetype and are same..netconnect(non-INR trxn) and sourcejet(INR trxn) are payment processor for the application.
sourcejet is the primary payment processor for INR based trxn and if the refund fails system makes a retry using the backup processor netconnect(non-INR trxn).

for example below messages will be printed in the log if refund process failed through sourcejet and system is making the retry attempt using netconnect.

<myapp.com.sys.BillingStrategy.performCredit(?:?):[***ROS CREDIT] attempting credit using the backup network adapter, adapter=SourcejetPaymentRoutingNetworkAdapter for ID=91113274385 and invoice=656578904>

in the above log id ID is bookingId in the refund log.

thank you.

0 Karma

iqbalintouch
Path Finder

@somesoni2 @woodcock could you please help.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...