Do you know what the message is, or is it dynamic?
You may be able to achieve this using the transaction
command with the maxpause
option. Here's some documentation on that. Your search would look something like this
your base search | transaction message maxpause=60m | stats count by message
http://docs.splunk.com/Documentation/Splunk/6.4.0/SearchReference/Transaction