How to find messages with duplicate keyvalue keys in a message?

Follow

Preet Sangha

• September 17, 2020 02:19

We have a issue where some logs messages have 'merged' in our code. We'd like to try find these messages.

Here is an example message:

2020-09-16T23:40:33.1399527+00:00
Severity=Information
Message=Blah Blah Blah Blah
AppVersion=1.0.01.01
ActivityStack=920e1f5e-a0ed-4224-b3f0-e8092767ab21,7747be97-c9c9-41b3-8a7a-b16157c28a50
ActivityDepth=2
MachineName=mc-temp-name
Timestamp=16 Sep 2020 23:40:32.101885
Application=TestApp
ActivityId=7747be97-c9c9-41b3-8a7a-b16157c28a50
ActivityStack=920e1f5e-a0ed-4224-b3f0-e8092767ab21,7747be97-c9c9-41b3-8a7a-b16157c28a50
ActivityDepth=2

As you can see it has two ActivityStack and ActivityDepth KVPs.

Can someone help us construct a query where we can

1. Find these messages in Sumo Logic
2. Determine how to count the number of some 'KEY' in a message 

0

• Official comment

  

  Rahul Choudhary

  • September 22, 2020 10:05

  Hi Preet,

  Yes, the multi-option allows you to parse multiple values within a single log message the way you have done in the query.

  See Parse multi.

   

  Regards,
  Rahul

   

  Comment actions Permalink
• 

  Preet Sangha

  • September 17, 2020 05:43

  Found it:
  
  _sourceCategory=*
  | parse regex "(?<activitystack>ActivityStack=)" multi
  | count by activitystack, _raw
  | where _count > 1

  0

  Comment actions Permalink

Please sign in to leave a comment.