Help with query

[dmtman]

Hello - I am new to splunk and am trying to do a search on data that calls out three different fields for duplicates so I can make a report out of that. Two of the fields are the name and serial number, and the third field is the name and serial number combined. Any help is appreciated, thanks.

[PickleRick]

What exactly do you mean by duplicates? A value that appears more than once in a given field (column)? Or a combined set of values from all fields?

[solarboyz1]

Without understanding the data, or the search your working with...

| your search
| stats count by name, serial_number, name_number
| search count>1

Any records that have identical names/serial number will show up.  You can adjust this as follows:

| your search
| stats count as count, values(serial_number) as serial_number, values(name_number) by name,
| search count>1

That would show if there we hosts with the same name, but might have different serial numbers.