SFTP File transfer folder count above threshold

Original query, unchanged.

let threshold = 10;
Syslog
| where ProcessName has "sftp"
    and SyslogMessage has "close "
    and SyslogMessage has " bytes read "
| parse SyslogMessage with "close \"" filepath "\" bytes read " readbytes: int " written " writtenbytes: int
| parse kind=regex filepath with dirpath:string "/" filename:string
| join kind=leftouter (
    Syslog
    | where ProcessName has "sftp" and SyslogMessage has "session opened for"
    | parse SyslogMessage with "session opened for local user " username: string " from [" src_ip "]"
    | project username, src_ip, ProcessID
    )
    on ProcessID
| project-away ProcessID1
| summarize count_distinct_dirpath=dcount(dirpath), dirlist=make_set(dirpath) by Computer, username, src_ip, bin(TimeGenerated, 15m)
| where count_distinct_dirpath >= threshold
| extend DirSample = iff(array_length(dirlist) == 1, tostring(dirlist[0]), strcat("SeeDirListField","_", tostring(hash(tostring(dirlist)))))