Are you looking for "IPs that exceeded 20 requests during some five second window" or for "IPs that average over 20 requests per five seconds (= four requests per second) over an arbitrary window"?
Assuming the latter, try this:
index=proxy http_status=403 OR http_status=407 | stats count by src_ip | addinfo | eval timerange = info_max_time - info_min_time | fields - info_* | eval rate = count / timerange | where rate > 4
The former is a bit more tricky if you want statistical accuracy. For example, it'd be easy to split each minute into twelve five-second buckets and count for each bucket. However, if you have 15 events at :04 and 15 events at :06 that'd statistically be "more than 20 in five seconds" but they'd be in different buckets so that would not trigger. If that inaccuracy is fine then use something like this:
index=proxy http_status=403 OR http_status=407 | bucket span=5s _time | stats count by _time src_ip | where count > 20
That would give you potentially splunkloads of rows per src_ip, consider adding another stats at the end if you want one row per host.
If that statistical accuracy is not fine then let me know and I'll cook up something more complicated but maybe more accurate.
... View more
