Splunk Search

extracting field using rex props.conf

JoshuaJohn
Contributor

I have data that looks like this:

**** Error  Wed Aug 24 09:36:52 CDT 204941272049412507  /nitro/com/t/Manager    Cexception for the payment id -     nitro.com.Exception: The field with id pg73180373180 failed to be authorized. Reason: mls_error_checkout_action_err_decline
    at com.nitropay.MLSManager.newAuthorize(MLSManager.java:450)
    at com.nitropay.MLSManager.authorize(MLSManager.java:320)
... 50 lines omitted ...

&

    **** Error  Wed Aug 24 09:36:29 CDT 2389657 /nitro/servlet/pipe/Manager/Scope-244474/nitro/com/cc/order/CartFormHandler MLSCSRModifierHandler (preAddItemToOrder), orderId:4585558558 profileId:22542   com.nitro.cc.order.MLSCartException: mls_error_cart_add_inactive_item
at com.nitro.cc.order.MLSCartVManager.validateAddItemToOrder(MLSCartVManager.java:109)
        at 

I am trying to extract mls_error_checkout_action_err_decline and mls_error_cart_add_inactive_item so I used this rex (?(mls_error_)\w+) and it seems to work fine when testing in a query but when I try to add it to the props.conf file the extracted field will not show up. This is what my query looks like in my props.conf: EXTRACT-mls_error = (?<mls_error>(mls_error_*)\w+)

(Note there is a asterisk after mls_error_(asterisk))

Any solutions?

0 Karma
1 Solution

somesoni2
Revered Legend

I don't see a reason to put a * in your regex. Also, I don't see it in your rex in search.

Try this for your props.conf

EXTRACT-mls_error = (?<mls_error>(mls_error_)\w+)

OR

EXTRACT-mls_error = (?<mls_error>mls_error_[^\s]+)

View solution in original post

somesoni2
Revered Legend

I don't see a reason to put a * in your regex. Also, I don't see it in your rex in search.

Try this for your props.conf

EXTRACT-mls_error = (?<mls_error>(mls_error_)\w+)

OR

EXTRACT-mls_error = (?<mls_error>mls_error_[^\s]+)
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! &#x1f308; In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...