Thank you for sharing sample data. This reveals additional weaknesses in the pursuit. ORDERS seems to be the ID that comes after TransNum, not extracted by the original regex at all. Sample data ...
See more...
Thank you for sharing sample data. This reveals additional weaknesses in the pursuit. ORDERS seems to be the ID that comes after TransNum, not extracted by the original regex at all. Sample data also show contradiction with your original index search. But that is more for you to fine tune. Part of the event is structured in JSON. This should be treated as a structure not literal strings. Extraction using regex is instable. Based on your sample events (which suggest that the source is exactly the same, therefore subsearch is really a bad approach), this would be a much better strategy index=source (("status for" "Not available") OR "Request for")
| rex "TransNum: (?<ORDERS>\S+) .*?(?<JSON>{.+})"
| spath input=JSON path=products{}
| mvexpand products{}
| spath input=products{}
| stats values(uniqueid) as uniqueid by ORDERS (Note the index search is purely based on sample data. You may need to tune it to actually include the correct events.) Your sample data will give you ORDERS uniqueid 629f2ad QSTRUJIK Here is an emulation of your data. Play with it and compare with real data and refine your search strategy | makeresults
| fields - _*
| eval data = mvappend("INFO [pool-9-thread-3] CLASS_NAME=Q, METHOD=, MESSAGE=response status for TransNum: 629f2ad - 400 | Response - {\"code\":0001,\"message\":\"Not available\",\"messages\":[],\"additionalTxnFields\":[]}",
"INFO [pool-9-thread-7] CLASS_NAME=Q, METHOD=, MESSAGE=Request for TransNum: 629f2ad - {\"address\":{\"billToThis\":true,\"country\":\"\",\"email\":\"******************\",\"firstname\":\"FN\",\"lastname\":\"LN\",\"postcode\":\"0\",\"salutation\":null,\"telephone\":\"+999999999999\"},\"deliveryMode\":\"\",\"payments\":[{\"amount\":10,\"code\":\"BFD\"}],\"products\":[{\"currency\":356,\"price\":600,\"qty\":2,\"uniqueid\":\"QSTRUJIK\"}],\"refno\":\"629f2ad\",\"syncOnly\":true}")
| mvexpand data
| rename data as _raw
| extract
``` the above emulates
index=source (("status for" "Not available") OR "Request for")
```