I'm trying to run a search on search results. The first search would bring back various logs and sourcetypes. I want to take the finished search, look at any source IP addresses that have more than 1 result and more than 1 sourcetype within a 5 minute time period. Any idea's on how I might be able to do this?
↧