Thanks in advance for your time and assistance.  I have a Splunk Enterprise Security correlation search intended to trigger when there are at least 20 events having the same values of FieldA and FieldB within 60 seconds.  Consistent with multiple resources within Splunk docs, I am using the below search.  The correlation search runs once every 30 minutes.  (Main search) | bin _time span=60s | stats count by FieldA FieldB | where count > 19 This should be straightforward, but the search has fired when there are 20 or more log entries with the same FieldA and FieldB values during the entire 30 minutes since the last correlation search, but definitely not 20 instances within the defined bin window of 60s. Is there some caveat of using the bin command that I am unaware of?  Is there a more reliable method to achieve the same objective? _Thanks_ ... View more