I assume you are searching a time window longer than 1 hour if you are using streamstats. If you are only searching 60 minutes, then stats will work. To collect the requestIDs, use values(requestID) in the streamstats command index=foo component="shop-service" | streamstats time_window=1h values(requestID) as requestIDs by category price | where mvcount(requestIDs) > 1 This will collect all unique requestIDs that have the same category and price and the mvcount() does the > 1 test.  Note that there are event limitations using streamstats with long time windows, see the docs, so be aware.   ... View more