index="REPLACE_WITH_AUTH_INDEX" sourcetype="REPLACE_WITH_AUTH_SOURCETYPE"
earliest=-7d latest=now
app="REPLACE_WITH_ADMIN_APPLICATION" user="REPLACE_WITH_ADMIN_ID"
action="success"
| stats count AS successful_events min(_time) AS first_seen
    max(_time) AS last_seen values(dest) AS destinations by user src
| sort 0 - successful_events
| head 100
| convert ctime(first_seen) ctime(last_seen)