Try this for the hour that you had the problem -
host=myhost "Received INVITE" OR "Sent Invite" OR "Sent re-Invite"
| eval XCount= if(match(_raw,"Received INVITE"),1,0)
| eval YCount= if(match(_raw,"Sent Invite" ),1,0)
| eval ZCount= if(match(_raw,"Sent re-Invite"),1,0)
| eval TCount= 1
| eval UCount=XCount+YCount+ZCount
| search Tcount!=UCount
If that gets no individual events that count as more than one type, then remove the last line and continue with this -
| bucket _time span=1h
| eventstats
count as CountSum, sum(TCount) as TSum, sum(UCount) as USum,
sum(XCount) as XSum, sum(YCount) as YSum, sum(ZCount) as ZSum
by _time
| where TSum != USum
That will return only the events that are in an hour where the two sums do not match, for further review.
