index="REPLACE_WITH_API_LOG_INDEX" sourcetype="REPLACE_WITH_API_SOURCETYPE" earliest=-24h latest=now
api_id="REPLACE_WITH_API_ID" http_method=GET status>=200 status<300
| rex field=uri_path "^/v1/customers/(?<object_id>[^/?]+)$"
| search object_id=*
| eval user=coalesce(user,"[unmapped]"), src=coalesce(src,"[unmapped]"), event_time=_time
| bin _time span=15m
| stats count AS requests dc(object_id) AS distinct_objects min(event_time) AS first_seen max(event_time) AS last_seen BY _time user src api_id
| where distinct_objects>=20
| sort 100 - distinct_objects