Splunk Search

IF NOT condition is not working in eval token in my the search query

man03359
Communicator

Hi,

I am trying to create 2 fields based on if condition. If in the logs, 200 Emv error or NoAcquirerFoundConfigured prints, capture it under Failed else print every other error under Declined.

eval Failed=if((Failure_Message=="200 Emv error " OR Failure_Message=="NoAcquirerFoundConfigured "),1,0)
eval Declined=if((Failure_Message!="200 Emv error " OR Failure_Message!="NoAcquirerFoundConfigured "),1,0)

But when my declined seems to print the 200 Emv error as well when I filter with search Declined=1

Sample logs - 

13/07/2023 12:26:51 (01) >> AdyenProxy::AdyenPaymentResponse::ProcessResponse::Response -> Result : Failure 13/07/2023 12:26:51 (01) >> AdyenProxy::AdyenPaymentResponse::ProcessPaymentFailure::Additional response -> Message : 200 Emv error ; Refusal Reason : 200 Emv error 

Labels (3)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Logically, Failure_Message!="200 Emv error " OR Failure_Message!="NoAcquirerFoundConfigured " and Failure_Message=="200 Emv error " are not mutually exclusive.  Any reason why Declined=1 should NOT include the latter?

0 Karma

man03359
Communicator

Yes, in my logs I am getting multiple errors printed but need to monitor only 2 errors : 200 Emv error and NoAcquirerFoundConfigured. So, I am using the logic -

if failure_message is equal to 200 Emv error or NoAcquirerFoundConfigured, it prints under Failed and rest every other error which is not equal to 00 Emv error or NoAcquirerFoundConfigured should come under Declined

Hence, 

eval Failed=if((Failure_Message=="200 Emv error " OR Failure_Message=="NoAcquirerFoundConfigured "),1,0)

eval Declined=if((Failure_Message!="200 Emv error " OR Failure_Message!="NoAcquirerFoundConfigured "),1,0)

0 Karma

yuanliu
SplunkTrust
SplunkTrust

The logical problem is, OR Failure_Message!="NoAcquirerFoundConfigured " does not preclude Failure_Message=="200 Emv error ".  There is no mutual exclusivity.

0 Karma

man03359
Communicator

This looks to be working - 

eval Msg=if((Failure_Message=="200 Emv error " OR Failure_Message=="NoAcquirerFoundConfigured "),"Failed","Declined")

 

Thanks a lot 🙂 

Happy Splunking

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...