https://community.splunk.com/t5/Splunk-Search/How-to-search-for-any-source-IP-addresses-that-have-more-than/m-p/217811#M64001 <P>Without seeing your search results, these are all best guess...</P> <PRE><CODE>... | bin span=5m _time | stats count by source_ip sourcetype _time | where count &gt; 1 </CODE></PRE> <P>You can test this with internal logs easily : </P> <PRE><CODE>index=_internal | stats count by sourcetype source _time | bin span=5m _time | where count &gt; 1 </CODE></PRE> Wed, 24 Feb 2016 17:25:34 GMT esix_splunk 2016-02-24T17:25:34Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-any-source-IP-addresses-that-have-more-than/m-p/217810#M64000 <P>I'm trying to run a search on search results. The first search would bring back various logs and sourcetypes. I want to take the finished search, look at any source IP addresses that have more than 1 result and more than 1 sourcetype within a 5 minute time period. Any idea's on how I might be able to do this? </P> Wed, 24 Feb 2016 16:38:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-any-source-IP-addresses-that-have-more-than/m-p/217810#M64000 502087470 2016-02-24T16:38:09Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-any-source-IP-addresses-that-have-more-than/m-p/217811#M64001 <P>Without seeing your search results, these are all best guess...</P> <PRE><CODE>... | bin span=5m _time | stats count by source_ip sourcetype _time | where count &gt; 1 </CODE></PRE> <P>You can test this with internal logs easily : </P> <PRE><CODE>index=_internal | stats count by sourcetype source _time | bin span=5m _time | where count &gt; 1 </CODE></PRE> Wed, 24 Feb 2016 17:25:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-any-source-IP-addresses-that-have-more-than/m-p/217811#M64001 esix_splunk 2016-02-24T17:25:34Z