index=<your JSON index> | spath input=<your field w/ nested JSON data> path={} | mvexpand {} | spath input={}
Find duplicate events
index=<specify index> | eval x=sha256(_raw) | stats count values(host) values(source) values(sourcetype) values(index) by x | where count>1
