Need to exract amountTendered

[yograjpatel]

EWS Response Content:{_ "responseHeader" : {_ "success" : "true",_ "serviceName" : "payment",_ "resourceName" : "payments",_ "operationName" : "create",_ "version" : "1.25.261",_ "statementCode" : "001",_ "methodOfPaymentSequence" : "1",_ "amountTendered" : "705.14",_ "balanceBegin" : "1410.79",_ "balanceEnd" : "705.65",_ "icomsTransactionDateTime" : "20180116",_ "message" : {_ "code" : "PAYMENT_AUTH_SUCCESS",_ "message" : "Payment has been authorized."_ }_ } ]_}

[yograjpatel]

rex field=_raw "amountTendered\"\s:\s\"(?[^\"]+)" tried this and it worked

[mayurr98 · Accepted solution]

hey @yograjpatel

Try this run anywhere search

| makeresults 
| eval _raw="EWS Response Content:{ \"responseHeader\" : { \"success\" : \"true\", \"serviceName\" : \"payment\", \"resourceName\" : \"payments\", \"operationName\" : \"create\", \"version\" : \"1.25.261\", \"statementCode\" : \"001\", \"methodOfPaymentSequence\" : \"1\", \"amountTendered\" : \"705.14\", \"balanceBegin\" : \"1410.79\", \"balanceEnd\" : \"705.65\", \"icomsTransactionDateTime\" : \"20180116\", \"message\" : { \"code\" : \"PAYMENT_AUTH_SUCCESS\", \"message\" : \"Payment has been authorized.\" } } ]}" 
| rex field=_raw "amountTendered\"\s:\s\"(?<amountTendered>[^\"]+)" 
| convert num(amountTendered)

In your environment, you should write

index=<your_index> 
| rex field=_raw "amountTendered\"\s:\s\"(?<amountTendered>[^\"]+)" 
| convert num(amountTendered)

Let me know if this helps !

[mayurr98]

Hey @yograjpatel
If you deem the posted answer is correct then pls accept/upvote to resolve this question.

[yograjpatel]

I'm getting the total count but not the actual amount to sum up.

[horsefez]

Hi,

yeah. We have extracted a string value. You need to convert it into a number first.

Just do the following after the "rex" command:
| convert num(amountTendered)

https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Convert

[yograjpatel]

tried this too rex "\"amountTendered\"\s:\s\"(?P\d+)\""

[horsefez]

did you really do the following:

| rex field=_raw "amountTendered\"\s*\:\s*(?<amountTendered>[^\"]+)"
| convert num(amountTendered)

[yograjpatel]

not working

[horsefez]

Hi,

how about a regular expression.

| rex field=_raw "amountTendered\"\s*\:\s*(?<amountTendered>[^\"]+)"