index="abc_prod_apache_access" ST=200 NOT (host="abc-xxx01.xyz.prod") | stats avg(US) as AverageResponseTime by host | bucket AverageResponseTime span=100
well, if the US field is a number of milliseconds already then the bucket span is correct. If the US field is a number of seconds then you'll want to use span="0.1" instead.
As for the overall report, this does pretty much what you asked for. Granted you'll probably want to end up with a
| sort AverageResponseTime on the end.
With that search you'll end up with a table where each row is a host, and the AverageResponseTime field will be things like "0.2-0.3", "0.3-0.4".
As a slightly different report, you might be interested in this report which is nicely chartable as a split-by column chart, where the bucketed response time intervals are on the x-axis and it's a frequency chart split by host...
index="abc_prod_apache_access" ST=200 NOT (host="abc-xxx01.xyz.prod") | bucket AverageResponseTime span="100" | chart count over AverageResponseTime by host
the below answer is incorrect. Here is the correct syntax:
index="abcprodapache_access" ST=200 NOT (host="abc-xxx01.xyz.prod") | bucket _time span=100ms | stats avg(US)as AverageResponseTime by _time host
Note that his question doesn't have to do with the _time field, but with the US field. So bucketing by time isn't what was asked for. I've updated my answer below and I still believe it's at least close to what they're looking for.