How to find messages with duplicate keyvalue keys in a message?
We have a issue where some logs messages have 'merged' in our code. We'd like to try find these messages.
Here is an example message:
2020-09-16T23:40:33.1399527+00:00
Severity=Information
Message=Blah Blah Blah Blah
AppVersion=1.0.01.01
ActivityStack=920e1f5e-a0ed-4224-b3f0-e8092767ab21,7747be97-c9c9-41b3-8a7a-b16157c28a50
ActivityDepth=2
MachineName=mc-temp-name
Timestamp=16 Sep 2020 23:40:32.101885
Application=TestApp
ActivityId=7747be97-c9c9-41b3-8a7a-b16157c28a50
ActivityStack=920e1f5e-a0ed-4224-b3f0-e8092767ab21,7747be97-c9c9-41b3-8a7a-b16157c28a50
ActivityDepth=2
As you can see it has two ActivityStack and ActivityDepth KVPs.
Can someone help us construct a query where we can
- Find these messages in Sumo Logic
- Determine how to count the number of some 'KEY' in a message
-
Official comment
Hi Preet,
Yes, the multi-option allows you to parse multiple values within a single log message the way you have done in the query.
See Parse multi.
Regards,
RahulComment actions
Please sign in to leave a comment.
Comments
2 comments