DQL Parse msg and extract data to new field

almog50 — Thu, 27 Feb 2025 11:29:01 GMT

Hi,
I have the following msg:

"Starting event processing. Event headers🔑s2k_bucketName, value:x-x-stg Key:w2w_objectUrl, value:processing/operations/2025/02/27/Operation-x-2025-02-24'T'19-20-00-stg.csv Key:s2k_lineNumber, value:3497 Key:event-id, value:8a37a48f-fbdf-3616-a751-217b3b2276c0 Key:eventId, value:8a37a48f-fbdf-3616-a751-217b3b2276c0 Key:type, value:x-operation-eod Key:eventType, value:x-operation-eod Key:timestamp, value:2025-02-27T10:22:27.688923215Z Key:timeStamp, value:2025-02-27T10:22:27.688928675Z Key:X-dynaTrace, value:��2�� ~@4�Ũ<.��2�� E~o��yO��C�%��ywr�� Key:traceparent, value:00-b3457e6f8699794fb28fac0c43cf25e2-f3797772a0ef1a95-01 Key:tracestate, value:34a1c5a8-a07e0240@dt=fw4;3;fcb932d5;f4;daa;0;0;33c;133b;2h01;3hfcb932d5;4hf4;5h01;6hb3457e6f8699794fb28fac0c43cf25e2;7hf3797772a0ef1a95 Key:x-request-id, value:ae6e7bdb-748a-328a-a5eb-2ff6ecaa9cf0 Key:is-eod, value:true. EventType: x-operation-eod Topic: eod-events (0/54544992) Key: "{ \"ts\": \"1740651747688\"}" "

I want to get Key:s2k_lineNumber, value:3497 into columns so I can sort by line numbers
can you please assist ?

Re: DQL Parse msg and extract data to new field

KeeganNelson — Thu, 27 Feb 2025 18:21:08 GMT

Hi almog50,

I was able to parse this log for you and pull the s2k_lineNumber. Here's the DQL query that I have created.

Here's a little run down to what the parse is doing.
1. First, I use LD (Line data) to search through the record until I see 's2k_lineNumber, value:'
2. Then I use INT so that the next time it sees an integer then it stores that value in s2k_lineNumber

The next step would be using the summarize function to sort the new column.

Hope this helps!

topic DQL Parse msg and extract data to new field in DQL

DQL Parse msg and extract data to new field

Re: DQL Parse msg and extract data to new field