https://community.splunk.com/t5/Deployment-Architecture/Persistent-Connections/m-p/361082#M19323 <P>index=firewall earliest=-24h@h latest=@h <BR /> | bucket _time span=10m <BR /> | stats count by _time, dst, dstport <BR /> | eventstats count(eval(count&gt;0)) AS periods_non_zero BY dst dstport <BR /> | search periods_non_zero&gt;=144</P> Tue, 29 Sep 2020 13:56:48 GMT DalJeanis 2020-09-29T13:56:48Z https://community.splunk.com/t5/Deployment-Architecture/Persistent-Connections/m-p/361081#M19322 <P>Hi!</P> <P>I believe the following search displays the number of connections in one hour over 24 hours. I am looking for a search to show connection count over a 10 minute span in the last 24 hours. Trying to find persistent connections. 1 connection to an external IP every 10 minutes for 24 hours.</P> <P>index=firewall earliest=-24h@h latest=@h | bucket _time span=1h | stats count by _time, dst, dstport | eventstats count(eval(count&gt;0)) AS hours_non_zero BY dst dstport | search hours_non_zero&gt;=24 </P> <P>Any help would be appreciated!</P> <P>Thank you!<BR /> Ashley</P> Tue, 29 Sep 2020 13:55:42 GMT https://community.splunk.com/t5/Deployment-Architecture/Persistent-Connections/m-p/361081#M19322 ashleyvander 2020-09-29T13:55:42Z https://community.splunk.com/t5/Deployment-Architecture/Persistent-Connections/m-p/361082#M19323 <P>index=firewall earliest=-24h@h latest=@h <BR /> | bucket _time span=10m <BR /> | stats count by _time, dst, dstport <BR /> | eventstats count(eval(count&gt;0)) AS periods_non_zero BY dst dstport <BR /> | search periods_non_zero&gt;=144</P> Tue, 29 Sep 2020 13:56:48 GMT https://community.splunk.com/t5/Deployment-Architecture/Persistent-Connections/m-p/361082#M19323 DalJeanis 2020-09-29T13:56:48Z