0

Need to extract customers msisdn (From) who have sent only one SMS (Received) and that too "STOP". Logs are below -

5/27/18 11:38:29.598 PM [2018-27-05 23:38:29.598 UTC] INFO pool-1-thread-3 [receivedSmsFileLogger] - Received = "JE S8 TELMA MALADE", From = "0765473387", Valid = "false" host = Vapp01SN source = D:\MIP\Logs\SMSC\Cycle1\received_sms.log sourcetype = MIP_Received_SMS

5/27/18 9:28:30.569 PM [2018-27-05 21:28:30.569 UTC] INFO pool-1-thread-2 [receivedSmsFileLogger] - Received = "''STOP''", From = "0765757431", Valid = "false" host = Vapp01SN source = D:\MIP\Logs\SMSC\Cycle1\received_sms.log sourcetype = MIP_Received_SMS

5/27/18 9:26:25.034 PM [2018-27-05 21:26:25.034 UTC] INFO pool-1-thread-1 [receivedSmsFileLogger] - Received = "1OUI", From = "0765757431", Valid = "false" host = Vapp01SN source = D:\MIP\Logs\SMSC\Cycle1\received_sms.log sourcetype = MIP_Received_SMS

5/27/18 9:06:36.889 PM [2018-27-05 21:06:36.889 UTC] INFO pool-1-thread-3 [receivedSmsFileLogger] - Received = "STOP", From = "0766108902", Valid = "true" host = Vapp01SN source = D:\MIP\Logs\SMSC\Cycle1\received_sms.log sourcetype = MIP_Received_SMS

Community
  • 1
  • 1
Sumit Pandey
  • 19
  • 3

1 Answers1

0

Try this

index=foo sourcetype=bar 
| rex "From\s*=\s*\\"(?<msisdn>\d+)" 
| rex "Received\s*=\s*\\"(?<msg>[^\\"]+)" 
| stats count(msg) as msgCount values(msg) as Msgs by msisdn 
| where msgCount=1 AND (mvindex(0,Msgs)=="STOP")
RichG
  • 9,063
  • 2
  • 18
  • 29