index="REPLACE_WITH_WEB_INDEX" sourcetype="REPLACE_WITH_WEB_SOURCETYPE" earliest=-7d
| bin _time span=10m
| stats count AS requests dc(uri_path) AS distinct_paths count(eval(status=404)) AS not_found count(eval(status>=500)) AS server_errors values(http_user_agent) AS agents BY _time src
| eval not_found_ratio=round(not_found/requests,2)
| where distinct_paths > 100 AND not_found_ratio > 0.5
| sort 0 - distinct_paths