Hello everyone.
I have a code below where each event is determined by the line break. I am wanting to take the value from the "InteractionId" parameter and check that there are no duplicates.
'
I believe it could be a regex that only filters by 'InteractionId' [str] = "value"
But I'm not sure.
2019-11-23T18:08:04.990 Trc 24102 Sending to Universal Routing Server: urs_ad_ucl_ctmm_p: 'EventRouteRequest' (71) message:
AttributeCustomerID [str] = "Resources"
AttributeConnID [long] = 093902ed259a99fc
AttributeMediaType [int] = -1
AttributeCallID [int] = 543269
AttributeCallType [int] = 0
'InteractionId' [str] = "00052aEWU1VF525"
'TenantId' [int] = 101
'MediaType' [str] = "email"
'InteractionType' [str] = "Inbound"
'InteractionSubtype' [str] = "InboundNew"
2019-11-24T18:08:04.990 Trc 24102 Sending to Universal Routing Server: urs_ad_ucl_ctmm_p: 'EventRouteRequest' (71) message:
AttributeCustomerID [str] = "Resources"
AttributeConnID [long] = 093902ed259a99fc
AttributeMediaType [int] = -1
AttributeCallID [int] = 543269
AttributeCallType [int] = 0
'InteractionId' [str] = "00052aEWU1VFB525"
'TenantId' [int] = 101
'MediaType' [str] = "email"
'InteractionType' [str] = "Inbound"
'InteractionSubtype' [str] = "InboundNew"
2019-11-25T18:08:04.990 Trc 24102 Sending to Universal Routing Server: urs_ad_ucl_ctmm_p: 'EventRouteRequest' (71) message:
AttributeCustomerID [str] = "Resources"
AttributeConnID [long] = 093902ed259a99fc
AttributeMediaType [int] = -1
AttributeCallID [int] = 543269
AttributeCallType [int] = 0
'InteractionId' [str] = "00052aEWU1VFB34B"
'TenantId' [int] = 101
'MediaType' [str] = "email"
'InteractionType' [str] = "Inbound"
'InteractionSubtype' [str] = "InboundNew"
Like this:
| makeresults
| eval raw="2019-11-23T18:08:04.990 Trc 24102 Sending to Universal Routing Server: urs_ad_ucl_ctmm_p: 'EventRouteRequest' (71) message:
AttributeCustomerID [str] = \"Resources\"
AttributeConnID [long] = 093902ed259a99fc
AttributeMediaType [int] = -1
AttributeCallID [int] = 543269
AttributeCallType [int] = 0
'InteractionId' [str] = \"00052aEWU1VF525\"
'TenantId' [int] = 101
'MediaType' [str] = \"email\"
'InteractionType' [str] = \"Inbound\"
'InteractionSubtype' [str] = \"InboundNew\"
:::2019-11-24T18:08:04.990 Trc 24102 Sending to Universal Routing Server: urs_ad_ucl_ctmm_p: 'EventRouteRequest' (71) message:
AttributeCustomerID [str] = \"Resources\"
AttributeConnID [long] = 093902ed259a99fc
AttributeMediaType [int] = -1
AttributeCallID [int] = 543269
AttributeCallType [int] = 0
'InteractionId' [str] = \"00052aEWU1VFB525\"
'TenantId' [int] = 101
'MediaType' [str] = \"email\"
'InteractionType' [str] = \"Inbound\"
'InteractionSubtype' [str] = \"InboundNew\"
:::2019-11-25T18:08:04.990 Trc 24102 Sending to Universal Routing Server: urs_ad_ucl_ctmm_p: 'EventRouteRequest' (71) message:
AttributeCustomerID [str] = \"Resources\"
AttributeConnID [long] = 093902ed259a99fc
AttributeMediaType [int] = -1
AttributeCallID [int] = 543269
AttributeCallType [int] = 0
'InteractionId' [str] = \"00052aEWU1VFB34B\"
'TenantId' [int] = 101
'MediaType' [str] = \"email\"
'InteractionType' [str] = \"Inbound\"
'InteractionSubtype' [str] = \"InboundNew\""
| makemv delim=":::" raw
| mvexpand raw
| rename raw AS _raw
| rename COMMENT AS "Everthing above generates sample event data; everything below is your solution"
| rex max_match=0 "\s+\'?(?<key>\S+)\'?\s\[\S+\]\s=\s\"?(?<value>[^\"\s]+)"
| eval _raw = mvzip(key, value, "=")
| kv
| eventstats count BY InteractionId
| where count > 1
If Each event is determined by the linebreak
then your situation is hopeless; surely that is not true! Are you sure it isn't that Each event is determined by timestamp
?
That's right, it's by timestamp.
The timestamp is breaking the event normally, my question is how much interactions within the 'Interaction' parameter [str] =