2018-01-25 03:01 PM
I have a custom event source that generates a huge xml file with lot of messages within. we transform that xml into a cef compatible event that looks like this (I put line breaks for better viewing):
HOST CEF:0|somevendor|someproduct|2|1|action|1|rt=01-24-2018 04:55:48,484 provgw=bla provgwinstance=instance2 virtualsrv=none executionTime=86
requestID=sdasdasda duser=dsa src=dsa random=-asd=success searchStatus=completeResult imsi=722310021231212 e
imsiActive=true mobileSubscriberType=genericSubscriber umtsSubscriber=true
accTypeGSM=true accTypeGSM=true accTypeGERAN=true accTypeGSM=true
accTypeUTRAN=true accTypeGSM=true wllSubscriber=false mscat=10 odboc=3
odbic=0 odbr=0 odboprc=0 odbssm=0 osb1=true clip=true clipOverride=false clir=3
colpOverride=false nwa=3 odbgprs=0 sr=1 odbsci=0 ts11=1234567890123
msisdn=1234567890123 msisdn=1234567890123
if you take a look, you will find that the msisdn appears (in this case) two times... resulting in a two exactly same metas.
here is a screenshot showing several times the same meta with the same value.
it's possible to just keep one?
thanks in advance,
Max