Detect identical events but different hosts

[mkamal18]

Hello,

I am searching all identical events that came from 2 different hosts.

Dedup is not working because the host is different.

Do you have an idea about how we can detect these types of events?

Thank you in advance

[elliotproebstel]

I recently needed to find logged SourceFire events that we defined as identical because they had the same message, source IP, source port, destination IP, and destination port. In this case, I created a string by concatenating all of these values together, and used this as a unique ID to track the event:

my search | eval unique_id=msg.src_ip.src_port.dest_ip.dest_port

If you can list the fields that, together, cause you to consider two events identical, then you can do the same thing, and then add something like this to the end:

... | stats count by unique_id | where count>1

[harsmarvania57]

Hi,

Can you please try this query?

your search | dedup _raw,_time