trim everything till refusal reason from the start

[man03359]

Hi,

I am trying to trim everything before the "211 Withdrawal amount exceeded: from the output --

WITHDRAWAL_AMOUNT_EXCEEDED; Refusal Reason: 211 Withdrawal amount exceeded.

But in my logs, at some events Refusal Reason is blank, so in that case I need to trim off the first part.

e.g.,

Validation failed: Total amount is lower than configured min amount. ; Refusal Reason 

MAINTENANCE; Refusal Reason:

please help

[richgalloway]

To trim the event at index-time, use SEDCMD in props.conf

SEDCMD-trimReason = s/.*(; Refusal Reason.*)/\1/

To trim it at search time, try this

| rex mode=sed "s/.*(; Refusal Reason.*)/\1/"

[ITWhisperer]

It is not clear what you are trying to do.

For a field with:

WITHDRAWAL_AMOUNT_EXCEEDED; Refusal Reason: 211 Withdrawal amount exceeded.

are you trying to set it to

211 Withdrawal amount exceeded.

And for a field with

Validation failed: Total amount is lower than configured min amount. ; Refusal Reason 

are you trying to set it to

Refusal Reason 

Or something else?

[man03359]

Yes, correct! 

For a field with:

WITHDRAWAL_AMOUNT_EXCEEDED; Refusal Reason: 211 Withdrawal amount exceeded.

 I am trying to capture 

211 Withdrawal amount exceeded.

and fields with 

And for a field with

Validation failed: Total amount is lower than configured min amount. ; Refusal Reason 

trying to capture 

Validation failed: Total amount is lower than configured min amount. 

[ITWhisperer · Accepted solution]

You have inconsistently used punctuation so this may not be correct, but hopefully you will get the idea

| rex "(?<reason>(.+(?=; Refusal Reason: $)|(?<=Refusal Reason: ).+))"

[man03359]

Thanks, but it did not worked for me as expected. So I finally used 2 regex to extract both the field values of Message and Refusal Reason into two separate fields.

Happy Splunking 🙂

[yuanliu]

In that case, you will need two rex commands to capture them:

| rex "Refusal Reason: *(?<refusal_reason>.+)"
| rex "(?<refusal_reason>.+) *; Refusal Reason$"

The first is anchored against colon (:) which the second event does not contain.  The second is anchored to the end of line after "Refusal Reason" which the first event does not meet.