Splunk Search

How to search for a count > X in one hour increments by IP?

jwalzerpitt
Influencer

How would I build a query to search for any time there is a count of > X amount in one-hour increments by IP?

For example, I'd like to see the exact count by IP if in the past 7 days there were> 1000 hits by that IP within each hour range.

Thx

0 Karma
1 Solution

kmaron
Motivator
(base search filtering) | bucket _time span=1h | stats count by IP _time | where count > 1000

View solution in original post

kmaron
Motivator
(base search filtering) | bucket _time span=1h | stats count by IP _time | where count > 1000

jwalzerpitt
Influencer

Beautiful! Thx so much

I did find this answer - https://answers.splunk.com/answers/55271/report-hourly-max-count-events-per-day-over-a-month.html - with the following query:

| stats count as hit by date_hour, date_mday
| eventstats max(hit) as maxhit by date_mday
| where hit=maxhit
| fields - maxhit

but it was not returning the results your short and sweet query does

Thx again

kmaron
Motivator

The big difference in that one is it's calculating the max for you and then comparing the count to the max. Since you have a static number to compare to it makes it much easier.

jwalzerpitt
Influencer

Thx again - greatly appreciated

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...