Get an overview of all 404 errors, an increase might be an IoC

index=web_p sourcetype="ms:iis:default" status=404 | timechart count