https://community.splunk.com/t5/Splunk-Search/filter-by-duplication-of-records/m-p/358756#M165324 <P>HI kunalpatil111<BR /> try something like this (to modify for your real needs):</P> <PRE><CODE>index=my_index | stats count BY IP | where count &gt;1 </CODE></PRE> <P>Bye.<BR /> Giuseppe</P> Fri, 10 Nov 2017 14:11:09 GMT gcusello 2017-11-10T14:11:09Z https://community.splunk.com/t5/Splunk-Search/filter-by-duplication-of-records/m-p/358755#M165323 <P>|tlp|lasttime|reporttime|count|itype|indicator|cc|asn|asn_desc|confidence|description|tags|rdata| provider .... i have the data as above, my aim is to filter data in such way so that i could get only duplicates, for eg: from indicator field i want only duplicates IP address </P> Fri, 10 Nov 2017 07:07:13 GMT https://community.splunk.com/t5/Splunk-Search/filter-by-duplication-of-records/m-p/358755#M165323 kunalpatil111 2017-11-10T07:07:13Z https://community.splunk.com/t5/Splunk-Search/filter-by-duplication-of-records/m-p/358756#M165324 <P>HI kunalpatil111<BR /> try something like this (to modify for your real needs):</P> <PRE><CODE>index=my_index | stats count BY IP | where count &gt;1 </CODE></PRE> <P>Bye.<BR /> Giuseppe</P> Fri, 10 Nov 2017 14:11:09 GMT https://community.splunk.com/t5/Splunk-Search/filter-by-duplication-of-records/m-p/358756#M165324 gcusello 2017-11-10T14:11:09Z https://community.splunk.com/t5/Splunk-Search/filter-by-duplication-of-records/m-p/358757#M165325 <P>@kunalpatil111 can you add some sample data? What do you want to output just the IPs that are duplicate in field <CODE>Indicator</CODE>?</P> Fri, 10 Nov 2017 20:55:04 GMT https://community.splunk.com/t5/Splunk-Search/filter-by-duplication-of-records/m-p/358757#M165325 niketn 2017-11-10T20:55:04Z