I am trying to create a search string to determine if any IP comes up more than 20 times in an hour.
You should be able to create an alert by setting
Alert's search: .... | stats count by ip | search count>20
Alert's condition: number of results > 0
Alert's scheduler: hourly