How would I build a query to search for any time there is a count of > X amount in one-hour increments by IP?
For example, I'd like to see the exact count by IP if in the past 7 days there were> 1000 hits by that IP within each hour range.
Thx
(base search filtering) | bucket _time span=1h | stats count by IP _time | where count > 1000
(base search filtering) | bucket _time span=1h | stats count by IP _time | where count > 1000
Beautiful! Thx so much
I did find this answer - https://answers.splunk.com/answers/55271/report-hourly-max-count-events-per-day-over-a-month.html - with the following query:
| stats count as hit by date_hour, date_mday
| eventstats max(hit) as maxhit by date_mday
| where hit=maxhit
| fields - maxhit
but it was not returning the results your short and sweet query does
Thx again
The big difference in that one is it's calculating the max for you and then comparing the count to the max. Since you have a static number to compare to it makes it much easier.
Thx again - greatly appreciated