Query to fetch IP addresses which has hit more than 10 req/sec

We have to fetch the number of IP addresses which has hit more than 10 req/sec and how many times did the IP breach the limit. We created a parsing rule to get the IP address from the message and used the below query but in this, we are not getting the number of times IP address has breached the limit.
SELECT rate(count(client_ip)>10, 1 second) from Log where hostname = ‘test’ FACET client_ip,account_id SINCE 1 week ago

Any suggestions would be highly appreciated!
Thanks!

1 Like