gauge="ProcessorResponse.Country[US]Processor[ApgProcessor]PaymentType[VISA] DECLINE" is one of the field.
I am trying to get Country, Processor, PaymentType and reason fields.
my search
| rex "Country[(?[^]]+)]Processor[(?[^]]+)]PaymentType[(?[^]]+)] (?[^"]+)"
I am using this but its not working, can someone help please.
Thanks for your time.
try this:
| makeresults count=1
| eval gauge="\"ProcessorResponse.Country[US]Processor[ApgProcessor]PaymentType[VISA] DECLINE\""
| rex field=gauge "\.Country\[(?<country>[^\]]+)\]Processor\[(?<processor>[^\]]+)\]PaymentType\[(?<payment_type>[^\]]+)\]\s+(?<result>[^\"]+)"
hope it helps
Hi dyude @sandeepmakkena ,
You can try this ,
index=your index
|rex field=gauge "ProcessorResponse\.Country\[(?P<Country>.+)\]Processor\[(?P<Processor>.+)\]PaymentType\[(?P<PaymentType>.+)\]\s(?P<reason>\w+)"
try this:
| makeresults count=1
| eval gauge="\"ProcessorResponse.Country[US]Processor[ApgProcessor]PaymentType[VISA] DECLINE\""
| rex field=gauge "\.Country\[(?<country>[^\]]+)\]Processor\[(?<processor>[^\]]+)\]PaymentType\[(?<payment_type>[^\]]+)\]\s+(?<result>[^\"]+)"
hope it helps
Thank you.