topic Re: help creating alert port 443 for 1 hour by action in Splunk Search https://community.splunk.com/t5/Splunk-Search/help-creating-alert-port-443-for-1-hour-by-action/m-p/523274#M147589 <P>the query if it works</P><P>I will keep in mind your suggestion about grouping</P><P>About the number of events I have been confused, just as indifferent to the number the help helps me</P><P>I don't know if I'm confused, I've seen queries where I put values ​​like "earliest = -30d" or "bucket _time span = 1s"</P> Tue, 06 Oct 2020 19:22:09 GMT splunkcol 2020-10-06T19:22:09Z help creating alert port 443 for 1 hour by action https://community.splunk.com/t5/Splunk-Search/help-creating-alert-port-443-for-1-hour-by-action/m-p/523246#M147584 <P>&nbsp;</P><P>I know that someone may have asked this, but the truth is I did not find anything similar.</P><P>I need to create a query for the events that exceed 500 attempts every 1 hour, when this happens an alert is generated.</P><P>index=* dest=200.22.22.22 dest_port=443 action=Accept |stats count by action src dest dest_port |where count &gt; 120 |sort -count</P> Tue, 06 Oct 2020 17:36:09 GMT https://community.splunk.com/t5/Splunk-Search/help-creating-alert-port-443-for-1-hour-by-action/m-p/523246#M147584 splunkcol 2020-10-06T17:36:09Z Re: help creating alert port 443 for 1 hour by action https://community.splunk.com/t5/Splunk-Search/help-creating-alert-port-443-for-1-hour-by-action/m-p/523250#M147585 <P>I presume the given query doesn't work or you wouldn't have posted here, but what is the problem with the query?&nbsp;&nbsp;</P><P>It's not necessary to group the stats by action since there is only one action value in the results.</P><P>If you want to know about more than 500 attempts in an hour, why does the query look for 120?</P> Tue, 06 Oct 2020 18:03:30 GMT https://community.splunk.com/t5/Splunk-Search/help-creating-alert-port-443-for-1-hour-by-action/m-p/523250#M147585 richgalloway 2020-10-06T18:03:30Z Re: help creating alert port 443 for 1 hour by action https://community.splunk.com/t5/Splunk-Search/help-creating-alert-port-443-for-1-hour-by-action/m-p/523274#M147589 <P>the query if it works</P><P>I will keep in mind your suggestion about grouping</P><P>About the number of events I have been confused, just as indifferent to the number the help helps me</P><P>I don't know if I'm confused, I've seen queries where I put values ​​like "earliest = -30d" or "bucket _time span = 1s"</P> Tue, 06 Oct 2020 19:22:09 GMT https://community.splunk.com/t5/Splunk-Search/help-creating-alert-port-443-for-1-hour-by-action/m-p/523274#M147589 splunkcol 2020-10-06T19:22:09Z