query to extract events with distict ids

[wye054]

Hi

i am trying to get all the request messages that passed through our application for a particular time frame . when i am searching using
sourcetype="*Leg .log" tid | eval status = if(error == 200, "OK", "Error")

getting below events with repeatition of transaction ids . How to get distict tid instead of repeating tids ....
please help me on this , i am a newbea to this ...
Time Event 1 1/13/14
11:20:54.000 PM
Mon Jan 13 2014 23:20:54 tid(7677232): certificate validation succeeded
date_month = january host = dev source = /opt/store/off_device_logging/Leg.log.
sourcetype = Leg .log
2 1/13/14
11:20:31.000 PM
Mon Jan 13 2014 23:20:31 tid(34223): Updating existing wsdl
date_month = january host = dev
source = /opt/store/off_device_logging/Leg .log sourcetype = Leg .log
3 1/13/14
11:20:31.000 PM
Mon Jan 13 2014 23:20 : tid(34223😞 wsdl Compilation Request
date_month = january host = dev source = /opt/store/off_device_logging/Leg .log
sourcetype = Leg .log
4 1/13/14
11:20:31.000 PM
Mon Jan 13 2014 23:20:31 : tid(8006898): HTTP response code 200
date_month = january host = dev source = /opt/store/off_device_logging/Leg .log
sourcetype = Leg .log
5 1/13/14
11:20:31.000 PM
Mon Jan 13 2014 23:20:31 tid(8006898): certificate validation succeeded
date_month = january host = dev
source = /opt/store/off_device_logging/Leg .log sourcetype = Leg .log

[somesoni2]

If the field tid or transactionId is already extracted use following

sourcetype="*Leg .log" tid | eval status = if(error == 200, "OK", "Error") | dedup tid

If the tid field is not extracted, use following

sourcetype="*Leg .log" tid | eval status = if(error == 200, "OK", "Error") | rex "\((?<tid>.*)\)" | dedup tid

you can save the regex to make it search time field extraction.

[linu1988]

Hello,
I would assume all the events are different, so we can have the tid's first then you can have your calculations

sourcetype="*Leg  .log" tid |rex field=_raw "\stid\((?<TID>\d+)"|dedup TID|eval status = if(error == 200, "OK", "Error") 

Give it a try. Thanks