index=REPLACE_WITH_NETWORK_INDEX sourcetype=REPLACE_WITH_NETWORK_SOURCETYPE earliest=-7d latest=now
src_ip="REPLACE_WITH_SOURCE_IP"
dest_ip IN ("91.219.237.110", "185.146.232.3", "96.9.125.59", "5.175.221.206")
| stats min(_time) AS first_seen max(_time) AS last_seen count AS events values(action) AS actions BY src_ip dest_ip dest_port
| sort 0 - last_seen
| head 100