Help creating an alert based on number of events per field

Path Finder

We're looking to create an alert based on the number of failures based on a certain field (clientIP) per certain time frame.

here is the search so far:

sourcetype="access_combined" POST 401 "/cas/login" | stats count by clientip

Basically, we only want to be alerted when the number of events from any unique clientIP hits 10 per minute. 

We have the alert to trigger if the number of results is greater than 9.

Labels (2)
0 Karma


If your search period is one minute, try this

sourcetype="access_combined" POST 401 "/cas/login"
| stats count by clientip
| where count > 9

Or if it is larger and you want to check the count in 1 minute buckets, try this

sourcetype="access_combined" POST 401 "/cas/login"
| timechart span=1m count by clientip
| untable _time clientip count
| where count > 9



Not sure if I understand it correctly, but if you are trying to trigger an alert if the no.of events is equal to 10, you can append the same condition in the query and in the alert conditions, trigger the alert only if you get any results.

sourcetype="access_combined" POST 401 "/cas/login"
| stats count by clientip
| search clientip=10


Get Updates on the Splunk Community!

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...