How to get a string from the INFO statement with an error response in Splunk

[baburao123]

Hello,
I need to get a string which is available in the INFO statement whenever there is an Warning statement in the log.

Example of Info Statement:
2018-03-19/11:12:24.502+0100 : INFO [ajp-nio-******][MESSAGE ID:***********] [ExiDecodingFilter] [ACTOR:*******] Payload decoded: ..................
**Example of Warning Statement:
2018-03-19/11:12:24.598+0100 : WARN [ajp-nio-******][MESSAGE ID:********] [AbstractService] [ACTOR:*********] Imsi not found in DB. CANNOT trigger garage process!

Requirement:
The "Message ID" and "ACTOR" remain the same in this case.
My requirement is to get the produce the "IMSI" which is not present in the WARN statement but available in the INFO statement.

Is it possible. Please help me out.

[baburao123]

Example INFO statement:
2018-03-19/11:12:24.502+0100 : INFO [ajp-nio-******][MESSAGE ID:***********] [ExiDecodingFilter] [ACTOR:*********] Payload decoded: p0:IMSI=.....

[p_gurav]

Try using Transaction command :
| transaction maxspan=1s Message_ID | rex field=_raw "IMSI=(?P\d+)"

[baburao123]

Thanks Gaurav.
But I want to first look into the Error message (WARN) and then check the IMSI data consecutively from the Request (INFO) which was sent earlier. Something like reverse engineering.

For this, I need to first check the response with the string "Imsi not found in DB. CANNOT trigger garage process!" and then extract the IMSI data from the relevant requests either using the ACTOR or the Message ID which is common across the complete communication flow.

[p_gurav]

Can you try putting in |search "*WARN*" after transaction command which will give only those transactions who has warning messages?