I recently needed to find logged SourceFire events that we defined as identical because they had the same message, source IP, source port, destination IP, and destination port. In this case, I created a string by concatenating all of these values together, and used this as a unique ID to track the event:
my search | eval unique_id=msg.src_ip.src_port.dest_ip.dest_port
If you can list the fields that, together, cause you to consider two events identical, then you can do the same thing, and then add something like this to the end:
... | stats count by unique_id | where count>1
