How to search for a count > X in one hour increments by IP?

[jwalzerpitt]

How would I build a query to search for any time there is a count of > X amount in one-hour increments by IP?

For example, I'd like to see the exact count by IP if in the past 7 days there were> 1000 hits by that IP within each hour range.

Thx

[kmaron · Accepted solution]

(base search filtering) | bucket _time span=1h | stats count by IP _time | where count > 1000

[jwalzerpitt]

Beautiful! Thx so much

I did find this answer - https://answers.splunk.com/answers/55271/report-hourly-max-count-events-per-day-over-a-month.html - with the following query:

| stats count as hit by date_hour, date_mday
| eventstats max(hit) as maxhit by date_mday
| where hit=maxhit
| fields - maxhit

but it was not returning the results your short and sweet query does

Thx again

[kmaron]

The big difference in that one is it's calculating the max for you and then comparing the count to the max. Since you have a static number to compare to it makes it much easier.

[jwalzerpitt]

Thx again - greatly appreciated