Splunk Search

extracting field using rex props.conf

JoshuaJohn
Contributor

I have data that looks like this:

**** Error  Wed Aug 24 09:36:52 CDT 204941272049412507  /nitro/com/t/Manager    Cexception for the payment id -     nitro.com.Exception: The field with id pg73180373180 failed to be authorized. Reason: mls_error_checkout_action_err_decline
    at com.nitropay.MLSManager.newAuthorize(MLSManager.java:450)
    at com.nitropay.MLSManager.authorize(MLSManager.java:320)
... 50 lines omitted ...

&

    **** Error  Wed Aug 24 09:36:29 CDT 2389657 /nitro/servlet/pipe/Manager/Scope-244474/nitro/com/cc/order/CartFormHandler MLSCSRModifierHandler (preAddItemToOrder), orderId:4585558558 profileId:22542   com.nitro.cc.order.MLSCartException: mls_error_cart_add_inactive_item
at com.nitro.cc.order.MLSCartVManager.validateAddItemToOrder(MLSCartVManager.java:109)
        at 

I am trying to extract mls_error_checkout_action_err_decline and mls_error_cart_add_inactive_item so I used this rex (?(mls_error_)\w+) and it seems to work fine when testing in a query but when I try to add it to the props.conf file the extracted field will not show up. This is what my query looks like in my props.conf: EXTRACT-mls_error = (?<mls_error>(mls_error_*)\w+)

(Note there is a asterisk after mls_error_(asterisk))

Any solutions?

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

I don't see a reason to put a * in your regex. Also, I don't see it in your rex in search.

Try this for your props.conf

EXTRACT-mls_error = (?<mls_error>(mls_error_)\w+)

OR

EXTRACT-mls_error = (?<mls_error>mls_error_[^\s]+)

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

I don't see a reason to put a * in your regex. Also, I don't see it in your rex in search.

Try this for your props.conf

EXTRACT-mls_error = (?<mls_error>(mls_error_)\w+)

OR

EXTRACT-mls_error = (?<mls_error>mls_error_[^\s]+)
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...