Splunk Search

How to search for a count > X in one hour increments by IP?

jwalzerpitt
Influencer

How would I build a query to search for any time there is a count of > X amount in one-hour increments by IP?

For example, I'd like to see the exact count by IP if in the past 7 days there were> 1000 hits by that IP within each hour range.

Thx

0 Karma
1 Solution

kmaron
Motivator
(base search filtering) | bucket _time span=1h | stats count by IP _time | where count > 1000

View solution in original post

kmaron
Motivator
(base search filtering) | bucket _time span=1h | stats count by IP _time | where count > 1000

jwalzerpitt
Influencer

Beautiful! Thx so much

I did find this answer - https://answers.splunk.com/answers/55271/report-hourly-max-count-events-per-day-over-a-month.html - with the following query:

| stats count as hit by date_hour, date_mday
| eventstats max(hit) as maxhit by date_mday
| where hit=maxhit
| fields - maxhit

but it was not returning the results your short and sweet query does

Thx again

kmaron
Motivator

The big difference in that one is it's calculating the max for you and then comparing the count to the max. Since you have a static number to compare to it makes it much easier.

jwalzerpitt
Influencer

Thx again - greatly appreciated

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...