Splunk Search

Regex by ID removing duplicates

leandromatperei
Path Finder

Hello everyone.

I have a code below where each event is determined by the line break. I am wanting to take the value from the "InteractionId" parameter and check that there are no duplicates.
'
I believe it could be a regex that only filters by 'InteractionId' [str] = "value"
But I'm not sure.

2019-11-23T18:08:04.990 Trc 24102 Sending to Universal Routing Server: urs_ad_ucl_ctmm_p: 'EventRouteRequest' (71) message:
    AttributeCustomerID [str] = "Resources"
    AttributeConnID [long] = 093902ed259a99fc
    AttributeMediaType [int] = -1
    AttributeCallID [int] = 543269
    AttributeCallType [int] = 0
 'InteractionId' [str] = "00052aEWU1VF525"
       'TenantId' [int] = 101
       'MediaType' [str] = "email"
       'InteractionType' [str] = "Inbound"
       'InteractionSubtype' [str] = "InboundNew"
2019-11-24T18:08:04.990 Trc 24102 Sending to Universal Routing Server: urs_ad_ucl_ctmm_p: 'EventRouteRequest' (71) message:
    AttributeCustomerID [str] = "Resources"
    AttributeConnID [long] = 093902ed259a99fc
    AttributeMediaType [int] = -1
    AttributeCallID [int] = 543269
    AttributeCallType [int] = 0
 'InteractionId' [str] = "00052aEWU1VFB525"
       'TenantId' [int] = 101
       'MediaType' [str] = "email"
       'InteractionType' [str] = "Inbound"
       'InteractionSubtype' [str] = "InboundNew"
2019-11-25T18:08:04.990 Trc 24102 Sending to Universal Routing Server: urs_ad_ucl_ctmm_p: 'EventRouteRequest' (71) message:
    AttributeCustomerID [str] = "Resources"
    AttributeConnID [long] = 093902ed259a99fc
    AttributeMediaType [int] = -1
    AttributeCallID [int] = 543269
    AttributeCallType [int] = 0
 'InteractionId' [str] = "00052aEWU1VFB34B"
       'TenantId' [int] = 101
       'MediaType' [str] = "email"
       'InteractionType' [str] = "Inbound"
       'InteractionSubtype' [str] = "InboundNew"
Tags (2)
0 Karma

woodcock
Esteemed Legend

Like this:

| makeresults 
| eval raw="2019-11-23T18:08:04.990 Trc 24102 Sending to Universal Routing Server: urs_ad_ucl_ctmm_p: 'EventRouteRequest' (71) message:
     AttributeCustomerID [str] = \"Resources\"
     AttributeConnID [long] = 093902ed259a99fc
     AttributeMediaType [int] = -1
     AttributeCallID [int] = 543269
     AttributeCallType [int] = 0
  'InteractionId' [str] = \"00052aEWU1VF525\"
        'TenantId' [int] = 101
        'MediaType' [str] = \"email\"
        'InteractionType' [str] = \"Inbound\"
        'InteractionSubtype' [str] = \"InboundNew\"
:::2019-11-24T18:08:04.990 Trc 24102 Sending to Universal Routing Server: urs_ad_ucl_ctmm_p: 'EventRouteRequest' (71) message:
     AttributeCustomerID [str] = \"Resources\"
     AttributeConnID [long] = 093902ed259a99fc
     AttributeMediaType [int] = -1
     AttributeCallID [int] = 543269
     AttributeCallType [int] = 0
  'InteractionId' [str] = \"00052aEWU1VFB525\"
        'TenantId' [int] = 101
        'MediaType' [str] = \"email\"
        'InteractionType' [str] = \"Inbound\"
        'InteractionSubtype' [str] = \"InboundNew\"
:::2019-11-25T18:08:04.990 Trc 24102 Sending to Universal Routing Server: urs_ad_ucl_ctmm_p: 'EventRouteRequest' (71) message:
     AttributeCustomerID [str] = \"Resources\"
     AttributeConnID [long] = 093902ed259a99fc
     AttributeMediaType [int] = -1
     AttributeCallID [int] = 543269
     AttributeCallType [int] = 0
  'InteractionId' [str] = \"00052aEWU1VFB34B\"
        'TenantId' [int] = 101
        'MediaType' [str] = \"email\"
        'InteractionType' [str] = \"Inbound\"
        'InteractionSubtype' [str] = \"InboundNew\""
| makemv delim=":::" raw
| mvexpand raw
| rename raw AS _raw

| rename COMMENT AS "Everthing above generates sample event data; everything below is your solution"

| rex max_match=0 "\s+\'?(?<key>\S+)\'?\s\[\S+\]\s=\s\"?(?<value>[^\"\s]+)"
| eval _raw = mvzip(key, value, "=")
| kv
| eventstats count BY InteractionId
| where count > 1
0 Karma

woodcock
Esteemed Legend

If Each event is determined by the linebreak then your situation is hopeless; surely that is not true! Are you sure it isn't that Each event is determined by timestamp?

0 Karma

leandromatperei
Path Finder

That's right, it's by timestamp.

The timestamp is breaking the event normally, my question is how much interactions within the 'Interaction' parameter [str] =

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...