Splunk Search

How to extract a field in using regex?

man03359
Communicator

I am relatively new to Splunk and I am trying to extracting fields in Splunk, 

I have a pattern I am attempting to extract and put into a field. The pattern looks like this:

AdyenPaymentResponse::ProcessResponse::Response -> Result : Failure
AdyenPaymentResponse::ProcessResponse::Response -> Result : Success

I am using this expression to match the pattern:

| rex field=_raw "AdyenPaymentResponse:.*\sResult\s:(?<Status>)"

I have to keep "AdyenPaymentResponse" as the base search and  I would like to extract this into a field called "Status" which shows only Failure or Success 

 

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Add the ".+" inside the brackets after <status>

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What is the question as this looks like it should work (although, depending on your data, you might want to use these slight modifications)

| rex field=_raw "AdyenPaymentResponse:.+\sResult\s:\s(?<Status>)"

Strictly speaking, you don't need field=_raw as this is the default field for rex

0 Karma

man03359
Communicator

It is not creating a field, the regex I am using

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You are right, I missed it too. You need to specify the pattern you want to be in the field

| rex field=_raw "AdyenPaymentResponse:.+\sResult\s:\s(?<Status>.+)"
0 Karma

man03359
Communicator

What should I modify exactly?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Add the ".+" inside the brackets after <status>

0 Karma

man03359
Communicator

Thanks a lot :slightly_smiling_face: It worked :slightly_smiling_face: :slightly_smiling_face:

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...