So the intent is to have a field that returns the time stamp of a large number of similar events (same punct field) if it meets a certain condition. For example let's say the number of events in a minute with a certain punct is more than 100. I would like to get both the punct and the time stamp as fields. What I have right now and what should be a good start is:
search_terms | bucket _time span=1m | stats count by punct,_time | stats mean(count),count by punct |eval test=if(count>100,"True","False")
All this will do however is see if the total number of events with that punct is greater than 100 not if the number of events in a single minute. I'll also need the sime stamp but that's not a problem after I get this first part working.