Alert if the same IP visits more than 20 times in an hour


I am trying to create a search string to determine if any IP comes up more than 20 times in an hour.

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

You should be able to create an alert by setting

Alert's search: .... | stats count by ip | search count>20

Alert's condition: number of results > 0

Alert's scheduler: hourly