I have the following search looking for external hosts that are trying to brute force multiple WordPress or Drupal sites:
index=foo sourcetype="f5:bigip:asm:syslog" action!=blocked uri="/*login.php" OR uri="/*admin/" OR uri="*user\/login" uri!="*revslider*" action!=blocked | stats count by src uri | sort -count | stats list(uri) as URI, list(count) as count, sum(count) as Total by src | sort -Total | head 10
Output is as follows:
How can I utilize stats dc to return only those results that have >5 URIs?
| stats dc(uri) as distinct_uri, values(uri) as URI, values(count) as count, sum(count) as Total by src | where distinct_uri > 5