IF NOT condition is not working in eval token in my the search query

[man03359]

Hi,

I am trying to create 2 fields based on if condition. If in the logs, 200 Emv error or NoAcquirerFoundConfigured prints, capture it under Failed else print every other error under Declined.

eval Failed=if((Failure_Message=="200 Emv error " OR Failure_Message=="NoAcquirerFoundConfigured "),1,0)
eval Declined=if((Failure_Message!="200 Emv error " OR Failure_Message!="NoAcquirerFoundConfigured "),1,0)

But when my declined seems to print the 200 Emv error as well when I filter with search Declined=1

Sample logs - 

13/07/2023 12:26:51 (01) >> AdyenProxy::AdyenPaymentResponse::ProcessResponse::Response -> Result : Failure 13/07/2023 12:26:51 (01) >> AdyenProxy::AdyenPaymentResponse::ProcessPaymentFailure::Additional response -> Message : 200 Emv error ; Refusal Reason : 200 Emv error 

• Error_Message = 200 Emv error
• Failure_Message = 200 Emv error
• Register = 04
• Status = Failure
• Store = tkg0554

[yuanliu]

Logically, Failure_Message!="200 Emv error " OR Failure_Message!="NoAcquirerFoundConfigured " and Failure_Message=="200 Emv error " are not mutually exclusive.  Any reason why Declined=1 should NOT include the latter?

[man03359]

Yes, in my logs I am getting multiple errors printed but need to monitor only 2 errors : 200 Emv error and NoAcquirerFoundConfigured. So, I am using the logic -

if failure_message is equal to 200 Emv error or NoAcquirerFoundConfigured, it prints under Failed and rest every other error which is not equal to 00 Emv error or NoAcquirerFoundConfigured should come under Declined

Hence, 

eval Failed=if((Failure_Message=="200 Emv error " OR Failure_Message=="NoAcquirerFoundConfigured "),1,0)

eval Declined=if((Failure_Message!="200 Emv error " OR Failure_Message!="NoAcquirerFoundConfigured "),1,0)

[yuanliu]

The logical problem is, OR Failure_Message!="NoAcquirerFoundConfigured " does not preclude Failure_Message=="200 Emv error ".  There is no mutual exclusivity.

[man03359]

This looks to be working - 

eval Msg=if((Failure_Message=="200 Emv error " OR Failure_Message=="NoAcquirerFoundConfigured "),"Failed","Declined")

Thanks a lot 🙂 

Happy Splunking