https://community.splunk.com/t5/Splunk-Search/Check-events-in-time/m-p/564661#M196692 <P>index="fw" app="ping"<BR />| bin _time span=10m<BR />| stats count by client_ip,dest_ip<BR />| stats list(dest_ip) AS dest_ip , list(count) AS count by client_ip<BR />| table client_ip , dest_ip , count<BR /><BR /><BR /></P><P><SPAN>I'd like to check the origin IP and destination IP that I pinged 10 times in 10 minutes.</SPAN><BR /><SPAN>However, this command calculates the number of times for all times.</SPAN><BR /><SPAN>Give me a hand with this.</SPAN></P> Wed, 25 Aug 2021 09:01:47 GMT noott211 2021-08-25T09:01:47Z https://community.splunk.com/t5/Splunk-Search/Check-events-in-time/m-p/564661#M196692 <P>index="fw" app="ping"<BR />| bin _time span=10m<BR />| stats count by client_ip,dest_ip<BR />| stats list(dest_ip) AS dest_ip , list(count) AS count by client_ip<BR />| table client_ip , dest_ip , count<BR /><BR /><BR /></P><P><SPAN>I'd like to check the origin IP and destination IP that I pinged 10 times in 10 minutes.</SPAN><BR /><SPAN>However, this command calculates the number of times for all times.</SPAN><BR /><SPAN>Give me a hand with this.</SPAN></P> Wed, 25 Aug 2021 09:01:47 GMT https://community.splunk.com/t5/Splunk-Search/Check-events-in-time/m-p/564661#M196692 noott211 2021-08-25T09:01:47Z https://community.splunk.com/t5/Splunk-Search/Check-events-in-time/m-p/564669#M196696 <P>You need to include _time in the stats commands</P><LI-CODE lang="markup">index="fw" app="ping" | bin _time span=10m | stats count by _time,client_ip,dest_ip | stats list(dest_ip) AS dest_ip , list(count) AS count by _time,client_ip | table _time, client_ip , dest_ip , count</LI-CODE> Wed, 25 Aug 2021 09:39:58 GMT https://community.splunk.com/t5/Splunk-Search/Check-events-in-time/m-p/564669#M196696 ITWhisperer 2021-08-25T09:39:58Z