filter by duplication of records

[kunalpatil111]

|tlp|lasttime|reporttime|count|itype|indicator|cc|asn|asn_desc|confidence|description|tags|rdata| provider .... i have the data as above, my aim is to filter data in such way so that i could get only duplicates, for eg: from indicator field i want only duplicates IP address

[niketn]

@kunalpatil111 can you add some sample data? What do you want to output just the IPs that are duplicate in field Indicator?

[gcusello]

HI kunalpatil111
try something like this (to modify for your real needs):

index=my_index
| stats count BY IP
| where count >1

Bye.
Giuseppe