https://community.splunk.com/t5/Monitoring-Splunk/How-to-filter-out-errors-that-occur-at-consecutive-intervals/m-p/622759#M9232 <P>This query returns the url with errors at 5m span, I just want to filter out those errors that occur at consecutive intervals, like 9:00 and 9:05.</P> <LI-CODE lang="markup">index = index uriPath=url* |bin span=5m _time I stats count as Volume, count(eval(httpCode&lt;=299)) as "Success" , count (eval (httpCode&gt;399)) as Fail by urlPath _time I eval F=round (Fail*100/Volume, 2) | where FP&gt; 2 and Volume &gt; 50</LI-CODE> <P> </P> Thu, 01 Dec 2022 16:38:31 GMT sid_arora 2022-12-01T16:38:31Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-filter-out-errors-that-occur-at-consecutive-intervals/m-p/622759#M9232 <P>This query returns the url with errors at 5m span, I just want to filter out those errors that occur at consecutive intervals, like 9:00 and 9:05.</P> <LI-CODE lang="markup">index = index uriPath=url* |bin span=5m _time I stats count as Volume, count(eval(httpCode&lt;=299)) as "Success" , count (eval (httpCode&gt;399)) as Fail by urlPath _time I eval F=round (Fail*100/Volume, 2) | where FP&gt; 2 and Volume &gt; 50</LI-CODE> <P> </P> Thu, 01 Dec 2022 16:38:31 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-filter-out-errors-that-occur-at-consecutive-intervals/m-p/622759#M9232 sid_arora 2022-12-01T16:38:31Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-filter-out-errors-that-occur-at-consecutive-intervals/m-p/622773#M9233 <LI-CODE lang="markup">index = index uriPath=url* |bin span=5m _time I stats count as Volume, count(eval(httpCode&lt;=299)) as "Success" , count (eval (httpCode&gt;399)) as Fail by urlPath _time I eval F=round (Fail*100/Volume, 2) | where FP&gt; 2 and Volume &gt; 50 | streamstats range(_time) as gap | where gap &gt; 300</LI-CODE> Thu, 01 Dec 2022 09:05:30 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-filter-out-errors-that-occur-at-consecutive-intervals/m-p/622773#M9233 ITWhisperer 2022-12-01T09:05:30Z