index=REPLACE_WITH_NETWORK_INDEX sourcetype=REPLACE_WITH_NETWORK_SOURCETYPE earliest=1793264400 latest=1793404800
src_ip="REPLACE_WITH_SOURCE_IP" dest_ip="134.209.82.225" (dest_port=22 OR dest_port=8099)
| stats count min(_time) AS first_seen max(_time) AS last_seen values(action) AS actions BY src_ip dest_ip dest_port
| sort 0 - last_seen
| head 100
| convert ctime(first_seen) ctime(last_seen)