index="*"  tag=fw action=blocked | stats values(dest) as dest by src | eval dest = dest | where dest > 10 ... View more