I am searching the my logs for key IDs that can either be from group 'AA' or group 'BB'. I find them by using rex and then display them in a table. (AA_12345 for example).
"ns=myApplication" "trying to insert document with keyId:"| rex field=message "(?(AA_\d+)|(BB_\d+))" | table id
Some of those key IDs are duplicates. I only want to show unique key IDs in the table. How can I do this? Based on some posts I found on here there is something called 'dedup' that might be useful here but I can't figure out where I'd insert it in my search query.
Any help is appreciated, thanks!
↧