How do you collect log within 1 hour from file log rotate?

[hiepdv4]

Dear all,

I have file log access /var/log/secure .
Use log rotate ( setting daily)
I need collect log login fail 3 times on 1 IP within 1 hour from file log /var/log/secure.
I used the following query:

> source="/var/log/secure" sourcetype=linux_secure process=sshd "password for" NOT pam_unix NOT Accepted earliest=-24h latest=now | rex field=_raw "(?Accepted|Failed) password for (?\w+) from (?[0-9A-Fa-f:\.]+)" | stats count by ipaddr | where count >=3

I need support collecting logs with 1 hours
Please support me.

[sudosplunk · Accepted solution]

Use timechart instead of stats, ...| timechart span=1h count by ipaddr | where count>2

OR

Use bin command, index=index source=source | bin _time span=1h |...rest of the search...|stats count by ipaddr | where count >2