How do I find matching events that occurred in the last 15 minutes?

[vwilson3]

I'm pretty new to Splunk and am learning every day. I have this search and I have to create an alert if more than 2 of these events happen in 15 minutes. For now, our alerts have to run once every hour. I've tried using "span", but that breaks up the hour into 15 minute blocks by time, not from the time the event occurred. Here's my search (sorry, had to remove specific data... you understand):

index=myindex field1="xxx" field2="222" |eventstats count by field3 |where count>2 |table _time host field1 field2 field3 field4 field5

Any tips, tricks, suggestions are greatly appreciated.

[nrduren1115]

Check out the timechart command. It lets you split by time and a certain field. You can specify how long you want the buckets to be as well. Below is the documentation.

http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Timechart