Splunk Search Streaming Window of more than X hits per minute by an ip for Y consecutive minutes.

gistfile1.txt

index=yourindexes sourcetype=access_combined uri_path=/login
| eval _time=relative_time(_time,"@m") 
| stats count by clientip,_time 
| where count > X 
| appendpipe 
  [ dedup clientip
  | map 
    [ gentimes increment=1m 
      [ noop 
      | stats count 
      | addinfo 
      | convert timeformat="%m/%d/%Y:%H:%M:%S" ctime(info_min_time) as start ctime(info_max_time) as end 
      | fields end start 
      | format "" "" "" "" "" ""
      ] 
    | eval _time=relative_time(starttime,"@m") 
    | eval clientip=$clientip$ 
    | eval count = 0
    ]
  ]
| stats sum(count) as count by clientip,_time 
| streamstats window=Y count(eval(count>0)) as windowhits by clientip 
| where windowhits = Y