Group By in search

[zservati1]

I have the following search :

index="efept" source=/var/log/efe/server.log host=efeprodapp13 FilingTypeId: AND Routing AND ApplicationId:

I like to get the count by applicationId/FilingTypeId pair, in other words I like to have the count for each applicationId and FilingTypeId.

Here is my sample data:

10:44:16.586 AM 2011-07-14 10:44:16,586 INFO [:ajp-0.0.0.0-8009-13] - Routing Message FROM TO <[queue/FILING-PROCESSOR], > Key=RoutingKey {FilingTypeId: DD-941-PAY AgencyId: IRS ApplicationId: QUICKB FilingPeriod: Y:2011 M:6 FilingState: null}

[pstamati]

For example :
index="efept" source=/var/log/efe/server.log host=efeprodapp13 FilingTypeId: AND Routing AND ApplicationId: |Stats dc("some field you want so summarize) By ApplicationID

Regards