1
Advanced Searching and Statistics
medium
The exhibit shows a search to find the top 5 URI-method combinations by count. However, the results show only 5 rows, but the analyst expected to see the top 5 URIs overall, not combinations. Which change to the search would achieve the desired result?
Exhibit
Refer to the exhibit. ``` index=web sourcetype=access_combined | rex "(?<ip>\d+\.\d+\.\d+\.\d+) (?<method>\w+) (?<uri>[^ ]+)" | stats count by uri, method | sort - count | head 5 ```