Splunk Search

How to search for a count > X in one hour increments by IP?

jwalzerpitt
Influencer

How would I build a query to search for any time there is a count of > X amount in one-hour increments by IP?

For example, I'd like to see the exact count by IP if in the past 7 days there were> 1000 hits by that IP within each hour range.

Thx

0 Karma
1 Solution

kmaron
Motivator
(base search filtering) | bucket _time span=1h | stats count by IP _time | where count > 1000

View solution in original post

kmaron
Motivator
(base search filtering) | bucket _time span=1h | stats count by IP _time | where count > 1000

jwalzerpitt
Influencer

Beautiful! Thx so much

I did find this answer - https://answers.splunk.com/answers/55271/report-hourly-max-count-events-per-day-over-a-month.html - with the following query:

| stats count as hit by date_hour, date_mday
| eventstats max(hit) as maxhit by date_mday
| where hit=maxhit
| fields - maxhit

but it was not returning the results your short and sweet query does

Thx again

kmaron
Motivator

The big difference in that one is it's calculating the max for you and then comparing the count to the max. Since you have a static number to compare to it makes it much easier.

jwalzerpitt
Influencer

Thx again - greatly appreciated

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...