Splunk Search

extract two different field values into one field using regex

man03359
Communicator

Hi All,

I am fairly new to Splunk and I have bit of a challenge in front of me which I am not able to resolve. I have the following event -

30/06/2023 12:23:15 (01) >> AdyenProxy::AdyenPaymentResponse::ProcessPaymentFailure::Additional response -> Message : 102 Shopper cancelled pin entry ; Refusal Reason : 102 Shopper cancelled pin entry

I am using the regex "rex field=_raw "AdyenPaymentResponse:.+\sReason\s:\s(?<Failure_Message>.+)" to extract the error message using refusal reason as the keyword as for some places the error printing under Message is irrelevant. But the problem I am facing is at some of the events the Refusal Reason field is empty and I have to capture the field value under Message eg --

"30/06/2023 12:18:39 (01) >> AdyenProxy::AdyenPaymentResponse::ProcessPaymentFailure::Additional response -> Message : MAINTENANCE ; Refusal Reason : "

I am trying to extract all the error messages under one field called Failure_Message.  Or to capture the Message part under same extracted field when Refusal Reason is empty. Is it possible ?

Labels (3)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

you need just to replace on rex the last + to * like 

index=_audit
| head 1
| eval _raw="30/06/2023 12:23:15 (01) >> AdyenProxy::AdyenPaymentResponse::ProcessPaymentFailure::Additional response -> Message : 102 Shopper cancelled pin entry ; Refusal Reason : 102 Shopper cancelled pin entry
30/06/2023 12:18:39 (01) >> AdyenProxy::AdyenPaymentResponse::ProcessPaymentFailure::Additional response -> Message : MAINTENANCE ; Refusal Reason : "
| multikv noheader=t
``` above creates test data ```
| rex "AdyenPaymentResponse:.+\sReason\s:\s(?<Failure_Message>.*)"

as my example shows.

r. Ismo 

BTW: Using "index=_audit | head 1" instead of "| makeresults" you will get "Selected and Interesting Fields" on left side panel 😉

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

you need just to replace on rex the last + to * like 

index=_audit
| head 1
| eval _raw="30/06/2023 12:23:15 (01) >> AdyenProxy::AdyenPaymentResponse::ProcessPaymentFailure::Additional response -> Message : 102 Shopper cancelled pin entry ; Refusal Reason : 102 Shopper cancelled pin entry
30/06/2023 12:18:39 (01) >> AdyenProxy::AdyenPaymentResponse::ProcessPaymentFailure::Additional response -> Message : MAINTENANCE ; Refusal Reason : "
| multikv noheader=t
``` above creates test data ```
| rex "AdyenPaymentResponse:.+\sReason\s:\s(?<Failure_Message>.*)"

as my example shows.

r. Ismo 

BTW: Using "index=_audit | head 1" instead of "| makeresults" you will get "Selected and Interesting Fields" on left side panel 😉

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...