I have a query which can give DIfferent IPS that are hitting to the top URI's  source= some source 404 | stats count values(Real_IP) as Real_IP by URI | sort - count I want to know out of these given IP's which IP occurred how many times in the same formate and in the same query   ... View more

I used this  query to get the count of Uri and IP  "index=*index* host="*host*" status = "400" OR "404" OR "500" OR "403" status!="200" status!="NULL" NOT "GoogleBot" status=404 | top limit=10 uri |where count > 9 | append[ search index=*index* source=*source*| top limit=10 Real_IP | where count > 10]" I need the query search that automatically it picks the highest value of Uri count and shows the IP address corresponding to this Uri  along with Uri  ... View more