Splunk Search

extract two different field values into one field using regex

man03359
Communicator

Hi All,

I am fairly new to Splunk and I have bit of a challenge in front of me which I am not able to resolve. I have the following event -

30/06/2023 12:23:15 (01) >> AdyenProxy::AdyenPaymentResponse::ProcessPaymentFailure::Additional response -> Message : 102 Shopper cancelled pin entry ; Refusal Reason : 102 Shopper cancelled pin entry

I am using the regex "rex field=_raw "AdyenPaymentResponse:.+\sReason\s:\s(?<Failure_Message>.+)" to extract the error message using refusal reason as the keyword as for some places the error printing under Message is irrelevant. But the problem I am facing is at some of the events the Refusal Reason field is empty and I have to capture the field value under Message eg --

"30/06/2023 12:18:39 (01) >> AdyenProxy::AdyenPaymentResponse::ProcessPaymentFailure::Additional response -> Message : MAINTENANCE ; Refusal Reason : "

I am trying to extract all the error messages under one field called Failure_Message.  Or to capture the Message part under same extracted field when Refusal Reason is empty. Is it possible ?

Labels (3)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

you need just to replace on rex the last + to * like 

index=_audit
| head 1
| eval _raw="30/06/2023 12:23:15 (01) >> AdyenProxy::AdyenPaymentResponse::ProcessPaymentFailure::Additional response -> Message : 102 Shopper cancelled pin entry ; Refusal Reason : 102 Shopper cancelled pin entry
30/06/2023 12:18:39 (01) >> AdyenProxy::AdyenPaymentResponse::ProcessPaymentFailure::Additional response -> Message : MAINTENANCE ; Refusal Reason : "
| multikv noheader=t
``` above creates test data ```
| rex "AdyenPaymentResponse:.+\sReason\s:\s(?<Failure_Message>.*)"

as my example shows.

r. Ismo 

BTW: Using "index=_audit | head 1" instead of "| makeresults" you will get "Selected and Interesting Fields" on left side panel 😉

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

you need just to replace on rex the last + to * like 

index=_audit
| head 1
| eval _raw="30/06/2023 12:23:15 (01) >> AdyenProxy::AdyenPaymentResponse::ProcessPaymentFailure::Additional response -> Message : 102 Shopper cancelled pin entry ; Refusal Reason : 102 Shopper cancelled pin entry
30/06/2023 12:18:39 (01) >> AdyenProxy::AdyenPaymentResponse::ProcessPaymentFailure::Additional response -> Message : MAINTENANCE ; Refusal Reason : "
| multikv noheader=t
``` above creates test data ```
| rex "AdyenPaymentResponse:.+\sReason\s:\s(?<Failure_Message>.*)"

as my example shows.

r. Ismo 

BTW: Using "index=_audit | head 1" instead of "| makeresults" you will get "Selected and Interesting Fields" on left side panel 😉

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...