Splunk Search
Highlighted

Field extraction

Contributor

gauge="ProcessorResponse.Country[US]Processor[ApgProcessor]PaymentType[VISA] DECLINE" is one of the field.
I am trying to get Country, Processor, PaymentType and reason fields.

my search
| rex "Country[(?[^]]+)]Processor[(?[^]]+)]PaymentType[(?[^]]+)] (?[^"]+)"

I am using this but its not working, can someone help please.

Thanks for your time.

0 Karma
Highlighted

Re: Field extraction

SplunkTrust
SplunkTrust

try this:

| makeresults count=1
| eval gauge="\"ProcessorResponse.Country[US]Processor[ApgProcessor]PaymentType[VISA] DECLINE\""
| rex field=gauge "\.Country\[(?<country>[^\]]+)\]Processor\[(?<processor>[^\]]+)\]PaymentType\[(?<payment_type>[^\]]+)\]\s+(?<result>[^\"]+)"

hope it helps

View solution in original post

0 Karma
Highlighted

Re: Field extraction

Contributor

Thank you.

0 Karma
Highlighted

Re: Field extraction

Contributor

Hi dyude @sandeepmakkena ,

You can try this ,

index=your index
|rex field=gauge "ProcessorResponse\.Country\[(?P<Country>.+)\]Processor\[(?P<Processor>.+)\]PaymentType\[(?P<PaymentType>.+)\]\s(?P<reason>\w+)"
0 Karma