How to search for a field that has occurred more than 50 times within a time period, say 5 mins ?

[shakeel12]

I have a search query like this,
index=ST sourcetype=CP | bin span=5m _time |stats dc(something) as total by _time,ip | where total >50

But this query only returns results occurred for every 5 mins not for every possible 5 mins.

The time column looks something like this.
_time
11:00
11:05
11:10
11:15

Is there a way to search for every instance of 5mins?

[cmerriman]

try something like this:

index=ST sourcetype=CP|sort 0 _time|streamstats time_window=5m dc(something) as total by ip|search total>50

see if that gets you what you're looking for. time_window looks for events within the last X seconds, minutes, etc.
http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Streamstats

if it doesn't work right, try putting the important data into a table before you do the streamstats.