Dear, I need to identify some duplicate events that are right after the "Call-ID:", however in Splunk I am not getting him to identify this field:
index=teste "*CALL-ID*" :
Aug 11 14:50:42 10.178.214.7 1 2020-08-11T14:50:41.979000-03:00 localhost GroupSeries - - [NXLOG@14506 EventReceivedTime="2020-08-11 14:50:42" SourceModuleName="plcmlog" SourceModuleType="im_file"] CEng: SIPMSG: Call-ID: 2932867290-4209
Aug 11 14:50:34 10.53.96.71 1 2020-08-11T14:50:25.326000-03:00 G7500-4D2120F2 GroupSeries - - [NXLOG@14506 EventReceivedTime="2020-08-11 14:50:34" SourceModuleName="plcmlog" SourceModuleType="im_file"] CEng: SIPMSG: Call-ID: 1112255280-4006
Aug 11 14:50:34 10.53.96.71 1 2020-08-11T14:50:25.080000-03:00 G7500-4D2120F2 GroupSeries - - [NXLOG@14506 EventReceivedTime="2020-08-11 14:50:34" SourceModuleName="plcmlog" SourceModuleType="im_file"] CEng: SIPMSG: Call-ID: 1112255280-4006
