detect repeating values over time

[stephen123]

Hi - I want to detect IP's which continually appear in the logs over a 24 hour period
They must appear at least once every hour over the 24 hours to be included in the results.

Thanks

[stephen123]

thanks - works perfect

[kristian_kolb · Accepted solution]

Assuming that you have the IP address in a field called ip, this is one of the ways to achieve this.

sourcetype=blah earliest=-1d | stats dc(date_hour) as hrs by ip | search hrs=24

Hope this helps,

Kristian

[jtrucks]

Mark it as correctly answered!

[stephen123]

Thanks - works perfect