Finding where multiple events have the same time

[mikelanghorst]

We had an issue here with one of our web fronted applications when the webserver received multiple requests to the same url down to the same millisecond. This caused the wrong file to be delivered to the first requestor. Obviously this was an issue with the code to allow the problem, but I couldn't think of how to find occurrences of this.

So for a given source, how to show where 2 or more events occur at the same time?

[ziegfried]

Just an alternative that might be a bit more efficient:

... | eventstats count by _time | where count>0

[RicoSuave · Accepted solution]

<yoursearch> | transaction _time | where eventcount > 1

[mikelanghorst]

Thanks, hadn't thought of using transaction. A bit more filtering and this will work great. Just that one step took the results from 5k, down to 342 results.