My requirement is to find duplicate events for a pattern that occurred in the same 'second' of timestamp after stripping the millisecond value. queries that I tried but didn't give me 100% success: search_pattern | timechart span=1s count | where count >1 search_pattern | timechart span=1s count | where count >1 | table _time, _raw Not sure if 'eventcount summarize=false' or 'eventstats' would be of any help here. P.S. I've recently started on splunk hence my knowledge is limited but I can work with pointers and do hit n trial approach. Any pointers are appreciated. ... View more