Splunk Search

extracting field using rex props.conf

JoshuaJohn
Contributor

I have data that looks like this:

**** Error  Wed Aug 24 09:36:52 CDT 204941272049412507  /nitro/com/t/Manager    Cexception for the payment id -     nitro.com.Exception: The field with id pg73180373180 failed to be authorized. Reason: mls_error_checkout_action_err_decline
    at com.nitropay.MLSManager.newAuthorize(MLSManager.java:450)
    at com.nitropay.MLSManager.authorize(MLSManager.java:320)
... 50 lines omitted ...

&

    **** Error  Wed Aug 24 09:36:29 CDT 2389657 /nitro/servlet/pipe/Manager/Scope-244474/nitro/com/cc/order/CartFormHandler MLSCSRModifierHandler (preAddItemToOrder), orderId:4585558558 profileId:22542   com.nitro.cc.order.MLSCartException: mls_error_cart_add_inactive_item
at com.nitro.cc.order.MLSCartVManager.validateAddItemToOrder(MLSCartVManager.java:109)
        at 

I am trying to extract mls_error_checkout_action_err_decline and mls_error_cart_add_inactive_item so I used this rex (?(mls_error_)\w+) and it seems to work fine when testing in a query but when I try to add it to the props.conf file the extracted field will not show up. This is what my query looks like in my props.conf: EXTRACT-mls_error = (?<mls_error>(mls_error_*)\w+)

(Note there is a asterisk after mls_error_(asterisk))

Any solutions?

0 Karma
1 Solution

somesoni2
Revered Legend

I don't see a reason to put a * in your regex. Also, I don't see it in your rex in search.

Try this for your props.conf

EXTRACT-mls_error = (?<mls_error>(mls_error_)\w+)

OR

EXTRACT-mls_error = (?<mls_error>mls_error_[^\s]+)

View solution in original post

somesoni2
Revered Legend

I don't see a reason to put a * in your regex. Also, I don't see it in your rex in search.

Try this for your props.conf

EXTRACT-mls_error = (?<mls_error>(mls_error_)\w+)

OR

EXTRACT-mls_error = (?<mls_error>mls_error_[^\s]+)
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...