| eventstats count as total_events by client_ip URL Method
| where total_events > 8
| sort client_ip URL Method _time
| streamstats current=f window=1 global=f last(_time) as prev_time by client_ip URL Method
| eval time_diff = _time - prev_time
| transaction client_ip URL Method maxpause=65s
| where time_diff >= 55 and eventcount > 8
This may not be exactly what you want, but perhaps it will give you some new ideas...
I used eventstats to eliminate as many client_ip's as I could, before creating the transactions. This should make the transaction command run faster. I also calculated the time difference between events so that I could use it later to implement the "minpause" idea.