Hi All! I want to calculate the sum of failed and declined  | eval Msg=if((Failure_Message=="200 Emv error " OR Failure_Message=="NoAcquirerFoundConfigured "),"Failed","Declined") Now I want to calculate the sum of failed and declined in the next line. I am already doing stats count of other fields, so need to add this one with them. Here is the one I am working on, but the problem is its not giving the output for Failed and Declined - Here is my query- index=idx-stores-pos sourcetype=GSTR:Adyen:log | transaction host startswith="Transaction started" maxpause=90s | search Failure OR Success | eval Store= substr(host,1,7) | eval Register= substr(host,8,2) | rex field=_raw "AdyenPaymentResponse:.+\sResult\s:\s(?<Status>.+)" | rex field=_raw "AdyenPaymentResponse:.+\sReason\s:\s(?<Failure_Message>.+)" | rex field=_raw "AdyenPaymentResponse:.+\sMessage\s:\s(?<Error_Message>.+)\;" | replace "* " with * in Error_Message Failure_Message | eval Msg=if((Failure_Message=="200 Emv error " OR Failure_Message=="NoAcquirerFoundConfigured "),"Failed","Declined") | stats count(eval(Status="Success")) AS Success_Count count(eval(Status="Failure")) AS Failure_Count sum(eval(Msg="Failed")) AS Failed sum(eval(Msg="Declined")) AS Declined By Store Register | eval Total_Payment= Success_Count + Failure_Count | table Store Register Success_Count Failure_Count Total_Payment Failed Declined ... View more

Hi, I am trying to trim everything before the "211 Withdrawal amount exceeded: from the output -- WITHDRAWAL_AMOUNT_EXCEEDED; Refusal Reason: 211 Withdrawal amount exceeded. But in my logs, at some events Refusal Reason is blank, so in that case I need to trim off the first part. e.g., Validation failed: Total amount is lower than configured min amount. ; Refusal Reason  MAINTENANCE; Refusal Reason:   please help ... View more

Hi All, I am fairly new to Splunk and I have bit of a challenge in front of me which I am not able to resolve. I have the following event - 30/06/2023 12:23:15 (01) >> AdyenProxy::AdyenPaymentResponse::ProcessPaymentFailure::Additional response -> Message : 102 Shopper cancelled pin entry ; Refusal Reason : 102 Shopper cancelled pin entry I am using the regex "rex field=_raw "AdyenPaymentResponse:.+\sReason\s:\s(?<Failure_Message>.+)" to extract the error message using refusal reason as the keyword as for some places the error printing under Message is irrelevant. But the problem I am facing is at some of the events the Refusal Reason field is empty and I have to capture the field value under Message eg -- "30/06/2023 12:18:39 (01) >> AdyenProxy::AdyenPaymentResponse::ProcessPaymentFailure::Additional response -> Message : MAINTENANCE ; Refusal Reason : " I am trying to extract all the error messages under one field called Failure_Message.  Or to capture the Message part under same extracted field when Refusal Reason is empty. Is it possible ? ... View more

Hi, I am relatively new to Splunk. I am trying to achieve the output as - Store Register Success_Count Failure_Count Total                                           I am using the below search query - index=idx-stores-pos sourcetype=GSTR:Adyen:log Success OR Failure | eval Store= substr(host,1,7)        ---------   extracting store and register from the host | eval Register= substr(host,8,2) | rex field=_raw "AdyenPaymentResponse:.+\sResult\s:\s(?<Status>.+)" | stats count as Status_Count by Status | eventstats sum(Status_Count) AS Total it is giving me this result - Status Status_Count Total Failure 23 597 Success 574 597         Please help! ... View more

I am relatively new to Splunk and I am trying to extracting fields in Splunk,  I have a pattern I am attempting to extract and put into a field. The pattern looks like this: AdyenPaymentResponse::ProcessResponse::Response -> Result : Failure AdyenPaymentResponse::ProcessResponse::Response -> Result : Success I am using this expression to match the pattern: | rex field=_raw "AdyenPaymentResponse:.*\sResult\s:(?<Status>)" I have to keep "AdyenPaymentResponse" as the base search and  I would like to extract this into a field called "Status" which shows only Failure or Success      ... View more