index="REPLACE_WITH_API_LOG_INDEX" sourcetype="REPLACE_WITH_API_SOURCETYPE" status=200 earliest=-30d
| rex field=uri_path "^/REPLACE_WITH_PROFILE_PATH/(?<object_id>[^/?]+)"
| where isnotnull(object_id)
| eval client=coalesce(user, src)
| bin _time span=1h
| stats dc(object_id) AS distinct_objects count AS requests dc(http_user_agent) AS user_agents BY _time client
| where distinct_objects > 50
| sort 0 - distinct_objects