I have a search query like this,
index=ST sourcetype=CP | bin span=5m _time |stats dc(something) as total by _time,ip | where total >50
But this query only returns results occurred for every 5 mins not for every possible 5 mins.
The time column looks something like this.
_time
11:00
11:05
11:10
11:15
Is there a way to search for every instance of 5mins?
try something like this:
index=ST sourcetype=CP|sort 0 _time|streamstats time_window=5m dc(something) as total by ip|search total>50
see if that gets you what you're looking for. time_window looks for events within the last X seconds, minutes, etc.
http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Streamstats
if it doesn't work right, try putting the important data into a table before you do the streamstats.