Trigger alert when 1 user deletes more than 5 files

[mishmeret]

hi, I want to create an alert that will trigger when 1 user (no specific user name, just one persong from the organization), deletes more than 5 files from DropBox.

I tried setting the following query:

host="ip-of-the-host-as-arrives-in-splunk" "event_type..tag"=file_delete | where count > 5

but how do I add the 1 user part ?

will love to get some help, I am new at this 

[ITWhisperer]

What information do you have in your events?

[mishmeret]

I have all information relating the user, user name, email address, ip, action, id, etc... 

[ITWhisperer]

| stats count by user