Limiting a Search by number of events over a period of time

[RyanDonnelly22]

I am trying to search for a number of events over a select period of time (4 hours) and then expand that to see how much of this traffic is in a 30 day period. I can use the time ranger picker for the initial 4 hours, but when expand it, I am getting too much data. 

Search I am using:

index="Firewalls" action=blocked

| stats count by client_ip

| search count > 3500

| sort -count

Is there a way to limit the results to be something like "search count > 3500 over 4 hours" and have the time range be 30 days?

[PickleRick]

There are at least two different methods. One is to generate set of timeranges and run separate search limiting results to your desired limit for each timerange using map command. A bit ugly and spawns many subsearches.

Second one would be to search for all the values but add a "counter" for each hour using streamstats and return only those results which counter is less or equal to the limit. Uses just one search,  but still needs to search throughout the whole outer timerange.

I'm far from my computer ATM so I won't write SPL...