Search for Duplicate RecordNumbers

[rmcdougal]

Basically, I want to create a search that will alert me in a forwarder is indexing the same data multiple times. We currently have a few that are and I want to see how many others are doing the same thing. So what I want is a search that will return the hostname of PC's that are indexing events with the same RecordNumber on the same day. I can't figure out how to accomplish it.

[ziegfried]

Assuming that the RecordNumber is an extracted field, you could use such a search to list all host having multiple occurrences of the same RecordNumber on a single day:

RecordNumber=* | eval day=strftime(_time,"%Y%m%d") | stats count by host,day,RecordNumber | where count>0

[tiny3001]

I know I'm resurrecting something old here... but shouldn't it be '| where count>1'

We currently running into this problem, and yes, the search above is definitely the best way of finding duplicates