Closed eemhu closed 9 months ago
Describe the bug
%dpl index=alert_examples earliest="01/01/2021:02:34:19" | rex4j field=_raw "message=(?<message>\"[a-zA-Z\s]+\"[^0-9])" | rex4j field=message "(?<message>[^\"]+)" | dedup message
results in one batch of data after which each batch is completely empty.
Expected behavior Deduplicate the message column
How to reproduce Run dpl command above
Software version pth-10 4.16.0-18-g11cc4941
internal pull request submitted
Merged to internal dpl2 branch
Describe the bug
results in one batch of data after which each batch is completely empty.
Expected behavior Deduplicate the message column
How to reproduce Run dpl command above
Software version pth-10 4.16.0-18-g11cc4941