SPL Code for rule: Potential Raspberry Robin Traffic is generating too much traffic. Help correct!

[thrashec]

| tstats allow_old_summaries=true summariesonly=t values(Web.dest_ip) as dest_ip, values(Web.http_referrer) as http_referrer, values(Web.http_user_agent) as http_user_agent, values(Web.url) as url, values(Web.user) as src_user
from datamodel=Web where (Web.src=* OR Web.url=*) by _time Web.src, Web.url
| `drop_dm_object_name("Web")`
| rename Web.src as src_host
| regex url= "^((?i)https?:\/\/)?\w{2,4}\.\w{2,6}:8080\/[a-zA-Z0-9]+\/.*?(?:-|\=|\?)"
| append [search index=audit_digitalguardian sourcetype=digitalguardian:process Application_Full_Name=msiexec.exe Command_Line="*:8080*" src_host="raspberryrobin.local"
| stats values(index) as index, values(sourcetype) as sourcetype, values(Command_Line) as cmdline, values(_raw) as payload by _time, src_host, url]

[ITWhisperer]

I am not clear what exactly you would like help with. Please expand on your issue, provide some anonymised representative sample events, give an idea of what your expected results are, an indication of what you are currently getting and why it is not what you were expecting.

[thrashec]

Expanded my search time results to 60 minutes as 24 hours or 30 days produced over a million events.
The 60 min search producing hundreds of thousands. 

Can you review this rule to see if there is anything within the SPL code that is incorrect?
It should only product less than hundred . . . if even that.