extract two different field values into one field using regex

[man03359]

Hi All,

I am fairly new to Splunk and I have bit of a challenge in front of me which I am not able to resolve. I have the following event -

30/06/2023 12:23:15 (01) >> AdyenProxy::AdyenPaymentResponse::ProcessPaymentFailure::Additional response -> Message : 102 Shopper cancelled pin entry ; Refusal Reason : 102 Shopper cancelled pin entry

I am using the regex "rex field=_raw "AdyenPaymentResponse:.+\sReason\s:\s(?<Failure_Message>.+)" to extract the error message using refusal reason as the keyword as for some places the error printing under Message is irrelevant. But the problem I am facing is at some of the events the Refusal Reason field is empty and I have to capture the field value under Message eg --

"30/06/2023 12:18:39 (01) >> AdyenProxy::AdyenPaymentResponse::ProcessPaymentFailure::Additional response -> Message : MAINTENANCE ; Refusal Reason : "

I am trying to extract all the error messages under one field called Failure_Message.  Or to capture the Message part under same extracted field when Refusal Reason is empty. Is it possible ?

[isoutamo · Accepted solution]

Hi

you need just to replace on rex the last + to * like 

index=_audit
| head 1
| eval _raw="30/06/2023 12:23:15 (01) >> AdyenProxy::AdyenPaymentResponse::ProcessPaymentFailure::Additional response -> Message : 102 Shopper cancelled pin entry ; Refusal Reason : 102 Shopper cancelled pin entry
30/06/2023 12:18:39 (01) >> AdyenProxy::AdyenPaymentResponse::ProcessPaymentFailure::Additional response -> Message : MAINTENANCE ; Refusal Reason : "
| multikv noheader=t
``` above creates test data ```
| rex "AdyenPaymentResponse:.+\sReason\s:\s(?<Failure_Message>.*)"

as my example shows.

r. Ismo 

BTW: Using "index=_audit | head 1" instead of "| makeresults" you will get "Selected and Interesting Fields" on left side panel 😉