Hello All, I would like to ask how to write statements to find users who meet continuity requests

[YL0J8K]

How can Splunk query which IPs have been requested continuously for more than 3 days? And there are multiple values in the firewallSource field, how can we know which IPs have both WAF and ATE in requests during a certain time period_ LIMITED?

[YL0J8K]

index="starshield" source="http-requests" "firewallSource" IN ("WAF","RATE_LIMIT") "botscore"<10
| stats count values(client.ip) as ip,values(firewallSource) by client.ip,clientRequest.httpHost