Rex in Case command?

[ad_no1]

Hi All

In the logs there are multiple Oracle codes with different reasons e.g.

Product Mapping Error ORA-20030: PKG_PRODUCTMAPPING.Usp_Getsyscodesforprocodes failed while checking if list of inputted pro_codes have all successfully been mapped. For network the following pro_codes were not mapped: A100036;

Product Mapping Error ORA-20029: PKG_PRODUCTMAPPING.Setdownstreammapping failed while checking for more than one possible sys_code mapping for a given pro_code (see sys_product_mapping for pro_code = D102124).

Product Mapping Error ORA-20027: PKG_PRODUCTMAPPING.Setdownstreammapping failed while checking list of PRO_CODE(s) for effective_date of 21-Apr-2013 00:00. List of products that don't have a status of Live for NEW customers: D102683(Withdrawn);

Is there a way to extract the code (A100036, D102124, D102683) depending on the Oracle error code?

I've been trying the following but getting an error saying "Error in 'eval' command: The expression is malformed. Expected )".

eval product_code=case( oracle_error_code=="ORA-20027", rex field=_raw "customers: (?<"product_code1.*>)(Withdrawn);" )

[lguinn2]

You can't put just any command into an eval statement - you can only use the eval functions.

Also, you seem to be trying to do this in an "if then else" in a procedural kind of way. You need to rethink that with Splunk.

Try this instead

rex field=_raw "customers:\s+(?<product_code>.*?)\("
| rex field=_raw "pro_codes were not mapped:\s+(?<product_code>.*?)\;"
| rex field=_raw "pro_codes\s+= \s+(?<product_code>.*?)\)"

Splunk will only create the product_code field when the event matches the regular expression; each event will (hopefully) only match one of them.