Alert for each time a field value is seen more than x times in a given time frame

[kevansrbfcu]

For example: If "fieldX" has many possible values(ex. 1 2 3 4 a b c d ...) we want to have Splunk send an alert email whenever any of these values are seen more than 10 times in 60mins.

Does anyone know a search that will work for this? Thanks in advance!

[ITWhisperer]

| stats count by fieldX
| where count > 10

Set your alert to run over the past 60 minutes e.g. earliest=-60m then trigger if there are any results.