I'm trying to run a search on search results. The first search would bring back various logs and sourcetypes. I want to take the finished search, look at any source IP addresses that have more than 1 result and more than 1 sourcetype within a 5 minute time period. Any idea's on how I might be able to do this?
Without seeing your search results, these are all best guess...
... | bin span=5m _time | stats count by source_ip sourcetype _time | where count > 1
You can test this with internal logs easily :
index=_internal | stats count by sourcetype source _time | bin span=5m _time | where count > 1