index="REPLACE_WITH_WEB_INDEX" sourcetype="REPLACE_WITH_WEB_SOURCETYPE" uri_path="REPLACE_WITH_CONFIRMATION_PAGE_PATH*" earliest=-30d
| where isnull(user) OR user="-"
| rex field=uri_query "(?i)(?:id|booking|reservation|ref)=(?<reference>[A-Za-z0-9-]{4,})"
| bin _time span=1h
| stats count AS requests dc(reference) AS distinct_references values(http_user_agent) AS agents BY _time src
| where distinct_references > 20
| sort 0 - distinct_references