fields @srcaddr, @dstport
|parse '* * * * * * * * * * * * * *'  as version, account_id, interface_id, srcaddr, dstaddr, srcport, dstport, protocol, packets, bytes, start, end, action, log_status
| stats count(*) as callsNotOnPort3306 by srcaddr, dstport
|filter dstport != 3306 and dstport != 80
| sort by callsNotOnPort3306 desc
| limit 20