topic Re: Regex by ID removing duplicates in Splunk Search

Regex by ID removing duplicates

leandromatperei — Wed, 27 Nov 2019 00:03:43 GMT

Hello everyone.

I have a code below where each event is determined by the line break. I am wanting to take the value from the "InteractionId" parameter and check that there are no duplicates.
'
I believe it could be a regex that only filters by 'InteractionId' [str] = "value"
But I'm not sure.

2019-11-23T18:08:04.990 Trc 24102 Sending to Universal Routing Server: urs_ad_ucl_ctmm_p: 'EventRouteRequest' (71) message:
    AttributeCustomerID [str] = "Resources"
    AttributeConnID [long] = 093902ed259a99fc
    AttributeMediaType [int] = -1
    AttributeCallID [int] = 543269
    AttributeCallType [int] = 0
 'InteractionId' [str] = "00052aEWU1VF525"
       'TenantId' [int] = 101
       'MediaType' [str] = "email"
       'InteractionType' [str] = "Inbound"
       'InteractionSubtype' [str] = "InboundNew"
2019-11-24T18:08:04.990 Trc 24102 Sending to Universal Routing Server: urs_ad_ucl_ctmm_p: 'EventRouteRequest' (71) message:
    AttributeCustomerID [str] = "Resources"
    AttributeConnID [long] = 093902ed259a99fc
    AttributeMediaType [int] = -1
    AttributeCallID [int] = 543269
    AttributeCallType [int] = 0
 'InteractionId' [str] = "00052aEWU1VFB525"
       'TenantId' [int] = 101
       'MediaType' [str] = "email"
       'InteractionType' [str] = "Inbound"
       'InteractionSubtype' [str] = "InboundNew"
2019-11-25T18:08:04.990 Trc 24102 Sending to Universal Routing Server: urs_ad_ucl_ctmm_p: 'EventRouteRequest' (71) message:
    AttributeCustomerID [str] = "Resources"
    AttributeConnID [long] = 093902ed259a99fc
    AttributeMediaType [int] = -1
    AttributeCallID [int] = 543269
    AttributeCallType [int] = 0
 'InteractionId' [str] = "00052aEWU1VFB34B"
       'TenantId' [int] = 101
       'MediaType' [str] = "email"
       'InteractionType' [str] = "Inbound"
       'InteractionSubtype' [str] = "InboundNew"

Re: Regex by ID removing duplicates

woodcock — Wed, 27 Nov 2019 00:29:41 GMT

If Each event is determined by the linebreak then your situation is hopeless; surely that is not true! Are you sure it isn't that Each event is determined by timestamp?

Re: Regex by ID removing duplicates

leandromatperei — Wed, 27 Nov 2019 00:42:33 GMT

That's right, it's by timestamp.

The timestamp is breaking the event normally, my question is how much interactions within the 'Interaction' parameter [str] =

Re: Regex by ID removing duplicates

woodcock — Wed, 27 Nov 2019 04:41:13 GMT

Like this:

| makeresults 
| eval raw="2019-11-23T18:08:04.990 Trc 24102 Sending to Universal Routing Server: urs_ad_ucl_ctmm_p: 'EventRouteRequest' (71) message:
     AttributeCustomerID [str] = \"Resources\"
     AttributeConnID [long] = 093902ed259a99fc
     AttributeMediaType [int] = -1
     AttributeCallID [int] = 543269
     AttributeCallType [int] = 0
  'InteractionId' [str] = \"00052aEWU1VF525\"
        'TenantId' [int] = 101
        'MediaType' [str] = \"email\"
        'InteractionType' [str] = \"Inbound\"
        'InteractionSubtype' [str] = \"InboundNew\"
:::2019-11-24T18:08:04.990 Trc 24102 Sending to Universal Routing Server: urs_ad_ucl_ctmm_p: 'EventRouteRequest' (71) message:
     AttributeCustomerID [str] = \"Resources\"
     AttributeConnID [long] = 093902ed259a99fc
     AttributeMediaType [int] = -1
     AttributeCallID [int] = 543269
     AttributeCallType [int] = 0
  'InteractionId' [str] = \"00052aEWU1VFB525\"
        'TenantId' [int] = 101
        'MediaType' [str] = \"email\"
        'InteractionType' [str] = \"Inbound\"
        'InteractionSubtype' [str] = \"InboundNew\"
:::2019-11-25T18:08:04.990 Trc 24102 Sending to Universal Routing Server: urs_ad_ucl_ctmm_p: 'EventRouteRequest' (71) message:
     AttributeCustomerID [str] = \"Resources\"
     AttributeConnID [long] = 093902ed259a99fc
     AttributeMediaType [int] = -1
     AttributeCallID [int] = 543269
     AttributeCallType [int] = 0
  'InteractionId' [str] = \"00052aEWU1VFB34B\"
        'TenantId' [int] = 101
        'MediaType' [str] = \"email\"
        'InteractionType' [str] = \"Inbound\"
        'InteractionSubtype' [str] = \"InboundNew\""
| makemv delim=":::" raw
| mvexpand raw
| rename raw AS _raw

| rename COMMENT AS "Everthing above generates sample event data; everything below is your solution"

| rex max_match=0 "\s+\'?(?<key>\S+)\'?\s\[\S+\]\s=\s\"?(?<value>[^\"\s]+)"
| eval _raw = mvzip(key, value, "=")
| kv
| eventstats count BY InteractionId
| where count > 1