I am relatively new to Splunk and I am trying to extracting fields in Splunk,
I have a pattern I am attempting to extract and put into a field. The pattern looks like this:
AdyenPaymentResponse::ProcessResponse::Response -> Result : Failure
AdyenPaymentResponse::ProcessResponse::Response -> Result : Success
I am using this expression to match the pattern:
| rex field=_raw "AdyenPaymentResponse:.*\sResult\s:(?<Status>)"
I have to keep "AdyenPaymentResponse" as the base search and I would like to extract this into a field called "Status" which shows only Failure or Success
What is the question as this looks like it should work (although, depending on your data, you might want to use these slight modifications)
| rex field=_raw "AdyenPaymentResponse:.+\sResult\s:\s(?<Status>)"
Strictly speaking, you don't need field=_raw as this is the default field for rex
It is not creating a field, the regex I am using
You are right, I missed it too. You need to specify the pattern you want to be in the field
| rex field=_raw "AdyenPaymentResponse:.+\sResult\s:\s(?<Status>.+)"
What should I modify exactly?
Add the ".+" inside the brackets after <status>
Thanks a lot 🙂 It worked 🙂 🙂