Break out search results by host

[DFresh4130]

I'm currently searching all of my jboss.out logs for SQLState. How can I break out the results with number of errors per host instead of a combined value? It'd be great if I can also have a graph created that's an overlay type which visualizes how many of those errors per host on top of each other for the same time period. Below is the query I have so far:

index="itdev" host="xxxxx*" source="/var/log/jboss/jboss.out" "SQLState" | sort - count

[gkanapathy · Accepted solution]

index="itdev" host="xxxxx*" source="/var/log/jboss/jboss.out" "SQLState" | stats count by host

[lguinn2]

And for the graph:

index="itdev" host="xxxxx*" source="/var/log/jboss/jboss.out" "SQLState" | timechart count by host

Put them together in a dashboard, maybe