DQL Parse msg and extract data to new field

[almog50]

Hi, 
I have the following msg:

"Starting event processing. Event headers🔑s2k_bucketName, value:x-x-stg Key:w2w_objectUrl, value:processing/operations/2025/02/27/Operation-x-2025-02-24'T'19-20-00-stg.csv Key:s2k_lineNumber, value:3497 Key:event-id, value:8a37a48f-fbdf-3616-a751-217b3b2276c0 Key:eventId, value:8a37a48f-fbdf-3616-a751-217b3b2276c0 Key:type, value:x-operation-eod Key:eventType, value:x-operation-eod Key:timestamp, value:2025-02-27T10:22:27.688923215Z Key:timeStamp, value:2025-02-27T10:22:27.688928675Z Key:X-dynaTrace, value:��2�� ��~@4�Ũ<
.
��2�� 
 �E~o��yO���C�%��ywr��� Key:traceparent, value:00-b3457e6f8699794fb28fac0c43cf25e2-f3797772a0ef1a95-01 Key:tracestate, value:34a1c5a8-a07e0240@dt=fw4;3;fcb932d5;f4;daa;0;0;33c;133b;2h01;3hfcb932d5;4hf4;5h01;6hb3457e6f8699794fb28fac0c43cf25e2;7hf3797772a0ef1a95 Key:x-request-id, value:ae6e7bdb-748a-328a-a5eb-2ff6ecaa9cf0 Key:is-eod, value:true. EventType: x-operation-eod Topic: eod-events (0/54544992) Key: "{ \"ts\": \"1740651747688\"}" "

I want to get Key:s2k_lineNumber, value:3497 into columns so I can sort by line numbers
can you please assist ?

[KeeganNelson]

Hi almog50, 

I was able to parse this log for you and pull the s2k_lineNumber. Here's the DQL query that I have created. 

Here's a little run down to what the parse is doing. 
1. First, I use LD (Line data) to search through the record until I see 's2k_lineNumber, value:' 
2. Then I use INT so that the next time it sees an integer then it stores that value in s2k_lineNumber

The next step would be using the summarize function to sort the new column.  

Hope this helps!