Tomcat - Server errors after multiple requests from same IP

Original query, unchanged.

let multi_errors = TomcatEvent
| where toint(HttpStatusCode) >= 500 and toint(HttpStatusCode) <= 599
| sort by EventStartTime asc
| summarize MultipleServerErrors = count() by SrcIpAddr, bin(EventStartTime, 5m)
| where MultipleServerErrors > 10;
let error_time_table = TomcatEvent
| where toint(HttpStatusCode) >= 500 and toint(HttpStatusCode) <= 599
| summarize error_time=min(EventStartTime) by SrcIpAddr
| join kind=innerunique (multi_errors) on SrcIpAddr;
TomcatEvent
| where toint(HttpStatusCode) >= 100 and toint(HttpStatusCode) <= 399
| summarize success_time=max(EventStartTime) by SrcIpAddr
| join kind=innerunique (error_time_table) on SrcIpAddr
| extend time_between_error_and_success = datetime_diff('second', error_time, success_time)
| where time_between_error_and_success between (1 .. 300)
| project time_between_error_and_success, error_time, success_time, SrcIpAddr
| extend IPCustomEntity = SrcIpAddr