How to create a search for Splunk alerts for duplicate events?

[wicke_s]

I am trying to create a splunk alert for duplicate data and would like some help in creating the splunk search. The data looks something like this for a giving search time duration

Server    Ping         ID
ref0120   60           125gt
ref0125   53           456hy
ref0365   45           125gt
ref0012   32           526yu

The alert should look for the following:
1. If I get more than 1 event for the same ID in the specified duration, Trigger an alert
2. In our example, we have 2 events with the same ID '125gt'. I want an alert to be triggered when this happens.

Any help would be greatly appreciated!

[richgalloway · Accepted solution]

Search for events and count them by ID. Eliminate those with a count of 1. If you get any results, trigger and alert.

<your search for events> | stats count, values(Server) as Server, values(Ping) as Ping by ID | where count > 1

[wicke_s]

This is awesome! I tested this and it works perfectly.

Thanks for your time!