Splunk Search

How to extract a field in using regex?

man03359
Communicator

I am relatively new to Splunk and I am trying to extracting fields in Splunk, 

I have a pattern I am attempting to extract and put into a field. The pattern looks like this:

AdyenPaymentResponse::ProcessResponse::Response -> Result : Failure
AdyenPaymentResponse::ProcessResponse::Response -> Result : Success

I am using this expression to match the pattern:

| rex field=_raw "AdyenPaymentResponse:.*\sResult\s:(?<Status>)"

I have to keep "AdyenPaymentResponse" as the base search and  I would like to extract this into a field called "Status" which shows only Failure or Success 

 

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Add the ".+" inside the brackets after <status>

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What is the question as this looks like it should work (although, depending on your data, you might want to use these slight modifications)

| rex field=_raw "AdyenPaymentResponse:.+\sResult\s:\s(?<Status>)"

Strictly speaking, you don't need field=_raw as this is the default field for rex

0 Karma

man03359
Communicator

It is not creating a field, the regex I am using

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You are right, I missed it too. You need to specify the pattern you want to be in the field

| rex field=_raw "AdyenPaymentResponse:.+\sResult\s:\s(?<Status>.+)"
0 Karma

man03359
Communicator

What should I modify exactly?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Add the ".+" inside the brackets after <status>

0 Karma

man03359
Communicator

Thanks a lot 🙂 It worked 🙂 🙂

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...