Help creating an alert based on number of events per field

[bigfatyeastroll]

We're looking to create an alert based on the number of failures based on a certain field (clientIP) per certain time frame.

here is the search so far:

sourcetype="access_combined" POST 401 "/cas/login" | stats count by clientip

Basically, we only want to be alerted when the number of events from any unique clientIP hits 10 per minute. 

We have the alert to trigger if the number of results is greater than 9.

[ITWhisperer]

If your search period is one minute, try this

sourcetype="access_combined" POST 401 "/cas/login"
| stats count by clientip
| where count > 9

Or if it is larger and you want to check the count in 1 minute buckets, try this

sourcetype="access_combined" POST 401 "/cas/login"
| timechart span=1m count by clientip
| untable _time clientip count
| where count > 9

[nadlurinadluri]

Not sure if I understand it correctly, but if you are trying to trigger an alert if the no.of events is equal to 10, you can append the same condition in the query and in the alert conditions, trigger the alert only if you get any results.

sourcetype="access_combined" POST 401 "/cas/login"
| stats count by clientip
| search clientip=10