How to find messages with duplicate keyvalue keys in a message?

Comments

2 comments

  • Official comment
    Avatar
    Rahul Choudhary

    Hi Preet,

    Yes, the multi-option allows you to parse multiple values within a single log message the way you have done in the query.

    See Parse multi.

     

    Regards,
    Rahul

     
    Comment actions Permalink
  • Avatar
    Preet Sangha

    Found it:

    _sourceCategory=*
    | parse regex "(?<activitystack>ActivityStack=)" multi
    | count by activitystack, _raw
    | where _count > 1

    0
    Comment actions Permalink

Please sign in to leave a comment.