Hi All,
I am fairly new to Splunk and I have bit of a challenge in front of me which I am not able to resolve. I have the following event -
30/06/2023 12:23:15 (01) >> AdyenProxy::AdyenPaymentResponse::ProcessPaymentFailure::Additional response -> Message : 102 Shopper cancelled pin entry ; Refusal Reason : 102 Shopper cancelled pin entry
I am using the regex "rex field=_raw "AdyenPaymentResponse:.+\sReason\s:\s(?<Failure_Message>.+)" to extract the error message using refusal reason as the keyword as for some places the error printing under Message is irrelevant. But the problem I am facing is at some of the events the Refusal Reason field is empty and I have to capture the field value under Message eg --
"30/06/2023 12:18:39 (01) >> AdyenProxy::AdyenPaymentResponse::ProcessPaymentFailure::Additional response -> Message : MAINTENANCE ; Refusal Reason : "
I am trying to extract all the error messages under one field called Failure_Message. Or to capture the Message part under same extracted field when Refusal Reason is empty. Is it possible ?
Hi
you need just to replace on rex the last + to * like
index=_audit
| head 1
| eval _raw="30/06/2023 12:23:15 (01) >> AdyenProxy::AdyenPaymentResponse::ProcessPaymentFailure::Additional response -> Message : 102 Shopper cancelled pin entry ; Refusal Reason : 102 Shopper cancelled pin entry
30/06/2023 12:18:39 (01) >> AdyenProxy::AdyenPaymentResponse::ProcessPaymentFailure::Additional response -> Message : MAINTENANCE ; Refusal Reason : "
| multikv noheader=t
``` above creates test data ```
| rex "AdyenPaymentResponse:.+\sReason\s:\s(?<Failure_Message>.*)"
as my example shows.
r. Ismo
BTW: Using "index=_audit | head 1" instead of "| makeresults" you will get "Selected and Interesting Fields" on left side panel 😉
Hi
you need just to replace on rex the last + to * like
index=_audit
| head 1
| eval _raw="30/06/2023 12:23:15 (01) >> AdyenProxy::AdyenPaymentResponse::ProcessPaymentFailure::Additional response -> Message : 102 Shopper cancelled pin entry ; Refusal Reason : 102 Shopper cancelled pin entry
30/06/2023 12:18:39 (01) >> AdyenProxy::AdyenPaymentResponse::ProcessPaymentFailure::Additional response -> Message : MAINTENANCE ; Refusal Reason : "
| multikv noheader=t
``` above creates test data ```
| rex "AdyenPaymentResponse:.+\sReason\s:\s(?<Failure_Message>.*)"
as my example shows.
r. Ismo
BTW: Using "index=_audit | head 1" instead of "| makeresults" you will get "Selected and Interesting Fields" on left side panel 😉