Hello everyone.
I have a code below where each event is determined by the line break. I am wanting to take the value from the "InteractionId" parameter and check that there are no duplicates.
'
I believe it could be a regex that only filters by 'InteractionId' [str] = "value"
But I'm not sure.
2019-11-23T18:08:04.990 Trc 24102 Sending to Universal Routing Server: urs_ad_ucl_ctmm_p: 'EventRouteRequest' (71) message:
AttributeCustomerID [str] = "Resources"
AttributeConnID [long] = 093902ed259a99fc
AttributeMediaType [int] = -1
AttributeCallID [int] = 543269
AttributeCallType [int] = 0
'InteractionId' [str] = "00052aEWU1VF525"
'TenantId' [int] = 101
'MediaType' [str] = "email"
'InteractionType' [str] = "Inbound"
'InteractionSubtype' [str] = "InboundNew"
2019-11-24T18:08:04.990 Trc 24102 Sending to Universal Routing Server: urs_ad_ucl_ctmm_p: 'EventRouteRequest' (71) message:
AttributeCustomerID [str] = "Resources"
AttributeConnID [long] = 093902ed259a99fc
AttributeMediaType [int] = -1
AttributeCallID [int] = 543269
AttributeCallType [int] = 0
'InteractionId' [str] = "00052aEWU1VFB525"
'TenantId' [int] = 101
'MediaType' [str] = "email"
'InteractionType' [str] = "Inbound"
'InteractionSubtype' [str] = "InboundNew"
2019-11-25T18:08:04.990 Trc 24102 Sending to Universal Routing Server: urs_ad_ucl_ctmm_p: 'EventRouteRequest' (71) message:
AttributeCustomerID [str] = "Resources"
AttributeConnID [long] = 093902ed259a99fc
AttributeMediaType [int] = -1
AttributeCallID [int] = 543269
AttributeCallType [int] = 0
'InteractionId' [str] = "00052aEWU1VFB34B"
'TenantId' [int] = 101
'MediaType' [str] = "email"
'InteractionType' [str] = "Inbound"
'InteractionSubtype' [str] = "InboundNew"
Like this:
| makeresults
| eval raw="2019-11-23T18:08:04.990 Trc 24102 Sending to Universal Routing Server: urs_ad_ucl_ctmm_p: 'EventRouteRequest' (71) message:
AttributeCustomerID [str] = \"Resources\"
AttributeConnID [long] = 093902ed259a99fc
AttributeMediaType [int] = -1
AttributeCallID [int] = 543269
AttributeCallType [int] = 0
'InteractionId' [str] = \"00052aEWU1VF525\"
'TenantId' [int] = 101
'MediaType' [str] = \"email\"
'InteractionType' [str] = \"Inbound\"
'InteractionSubtype' [str] = \"InboundNew\"
:::2019-11-24T18:08:04.990 Trc 24102 Sending to Universal Routing Server: urs_ad_ucl_ctmm_p: 'EventRouteRequest' (71) message:
AttributeCustomerID [str] = \"Resources\"
AttributeConnID [long] = 093902ed259a99fc
AttributeMediaType [int] = -1
AttributeCallID [int] = 543269
AttributeCallType [int] = 0
'InteractionId' [str] = \"00052aEWU1VFB525\"
'TenantId' [int] = 101
'MediaType' [str] = \"email\"
'InteractionType' [str] = \"Inbound\"
'InteractionSubtype' [str] = \"InboundNew\"
:::2019-11-25T18:08:04.990 Trc 24102 Sending to Universal Routing Server: urs_ad_ucl_ctmm_p: 'EventRouteRequest' (71) message:
AttributeCustomerID [str] = \"Resources\"
AttributeConnID [long] = 093902ed259a99fc
AttributeMediaType [int] = -1
AttributeCallID [int] = 543269
AttributeCallType [int] = 0
'InteractionId' [str] = \"00052aEWU1VFB34B\"
'TenantId' [int] = 101
'MediaType' [str] = \"email\"
'InteractionType' [str] = \"Inbound\"
'InteractionSubtype' [str] = \"InboundNew\""
| makemv delim=":::" raw
| mvexpand raw
| rename raw AS _raw
| rename COMMENT AS "Everthing above generates sample event data; everything below is your solution"
| rex max_match=0 "\s+\'?(?<key>\S+)\'?\s\[\S+\]\s=\s\"?(?<value>[^\"\s]+)"
| eval _raw = mvzip(key, value, "=")
| kv
| eventstats count BY InteractionId
| where count > 1
If Each event is determined by the linebreak then your situation is hopeless; surely that is not true! Are you sure it isn't that Each event is determined by timestamp?
That's right, it's by timestamp.
The timestamp is breaking the event normally, my question is how much interactions within the 'Interaction' parameter [str] =