Hi, I want to know if there are more than one logs with the same message and the same uuid.
Eg:
This an error for user with id: 1
This an error for user with id: 2
This an error for user with id: 1
This an error for user with id: 3
I want to know if there are cases like 1
& 3
where the log is exactly the same but the user id is automatically generated.
Assuming you have the message and uuid extracted into fields already:
...
| eventstats count by message,uuid
| where count>1