help creating alert port 443 for 1 hour by action

[splunkcol]

I know that someone may have asked this, but the truth is I did not find anything similar.

I need to create a query for the events that exceed 500 attempts every 1 hour, when this happens an alert is generated.

index=* dest=200.22.22.22 dest_port=443 action=Accept |stats count by action src dest dest_port |where count > 120 |sort -count

[richgalloway]

I presume the given query doesn't work or you wouldn't have posted here, but what is the problem with the query?  

It's not necessary to group the stats by action since there is only one action value in the results.

If you want to know about more than 500 attempts in an hour, why does the query look for 120?

[splunkcol]

the query if it works

I will keep in mind your suggestion about grouping

About the number of events I have been confused, just as indifferent to the number the help helps me

I don't know if I'm confused, I've seen queries where I put values ​​like "earliest = -30d" or "bucket _time span = 1s"