Sure, Thanks for your hint which helped me figure it out. ... View more

Thanks, Sukisen. The query works but now computed arraySize value is for the only first element in the array and not for the complete array. ... View more

Using above example: I added one more duplicate "val4" to above example and tried this query: | makeresults | eval raw="val1" | append [| makeresults | eval raw="val1" ] | append [| makeresults | eval raw="val2"] | append [| makeresults | eval raw="val2" ] | append [| makeresults | eval raw="val3" ]| append [| makeresults | eval raw="val4" ] | append [| makeresults | eval raw="val4" ] | stats count(raw) as count by raw | eventstats sum(count) as total_count | where count > 1 |eventstats count as dup_count | table dup_count,total_count It correctly returns dup_count as 3 and total_count 7 , but it is repeated three times for each duplicated value (val1,val2,val3) , but I just need one. Piping it to | dedup total_count works for this eg: but not for the actual use case in which I am also trying to bucket stats by 1 day. ... View more

Thanks that works!. But I actually want to count the duplicates and also bucket it by time. Here what I tried: basesearch | bin _time span=1d| stats count by payload,_time | eventstats sum(count) as total | where count > 1 | eventstats count as dup_count | table count, dup_count, total This works, but one problem. The results are repeated for each value of payload and _time. How can I get just one result for each day. Basically, I am trying to find the percentage of duplicate payloads per day by computing count of duplicate payloads per day and total number of payloads ... View more