how to time range

[nnonm111]

index="*"

| stats count by clientip, productId

| stats list(productId) AS productId list(count) AS count by clientip

I want to get information that has been released more than 10 times in an hour from the time the log was detected, not the current time standard in the command.

[isoutamo]

Hi

I'm not exactly sure what you are wanting, but I think that you should use streamstats to generate count for sliding 1 hour span or eventstats with bin before it to get e.g. exactly one hour spans like 0-1, 1-2 etc.

https://docs.splunk.com/Documentation/Splunk/8.2.2/SearchReference/Streamstats

https://docs.splunk.com/Documentation/Splunk/8.2.2/SearchReference/Eventstats

r. Ismo