https://community.splunk.com/t5/Splunk-Search/How-to-count-each-IP-every-6-hours-since-its-first-timestamp/m-p/544374#M154185 <P>Hi,</P><P>I recieved the following question which I was not able to answer:</P><P>Let's simulate a system that charges each event by its IP (clientip). Each time we encounter an<BR />IP it is charged by 1 cent.<BR />There is however a grace period: whenever an IP is charged, for the subsequent 6 hours it will<BR />not be re-charged again.<BR />What will be the charge for the entire sample data? What is the query used?</P><P>*I used the "tutorialdata" dataset.</P><P>Thanks</P> Thu, 18 Mar 2021 17:04:50 GMT stavc 2021-03-18T17:04:50Z https://community.splunk.com/t5/Splunk-Search/How-to-count-each-IP-every-6-hours-since-its-first-timestamp/m-p/544374#M154185 <P>Hi,</P><P>I recieved the following question which I was not able to answer:</P><P>Let's simulate a system that charges each event by its IP (clientip). Each time we encounter an<BR />IP it is charged by 1 cent.<BR />There is however a grace period: whenever an IP is charged, for the subsequent 6 hours it will<BR />not be re-charged again.<BR />What will be the charge for the entire sample data? What is the query used?</P><P>*I used the "tutorialdata" dataset.</P><P>Thanks</P> Thu, 18 Mar 2021 17:04:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-each-IP-every-6-hours-since-its-first-timestamp/m-p/544374#M154185 stavc 2021-03-18T17:04:50Z https://community.splunk.com/t5/Splunk-Search/How-to-count-each-IP-every-6-hours-since-its-first-timestamp/m-p/549205#M155814 <P>Can you make some assumptions?</P> Fri, 23 Apr 2021 23:57:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-each-IP-every-6-hours-since-its-first-timestamp/m-p/549205#M155814 MayteP 2021-04-23T23:57:37Z