How to get count of each source by IP ?

[Vani_26]

Query:
|tstats count where index=afg-juhb-appl   host_ip=*     source=*     TERM(offer)

i want to get the count of each source by host_ip as shown below.
output:

source	11.56.67.12	11.56.67.15	11.56.67.18	11.56.67.19
/app/clts/shift.logs	987	67	67	89
/apps/lts/server.logs	45	45	67	43
/app/mts/catlog.logs	89	89	65	56
/var/http/show.logs	12	87	43	65

[richgalloway]

What does the current query give you?  Is the offer field indexed?

Have you tried grouping by host_ip?

|tstats count where index=afg-juhb-appl host_ip=* source=* TERM(offer) by host_ip

[Vani_26]

hi @richgalloway 

1. What does the current query give you?  Is the offer field indexed?

No offrer  field is not an index field.

2. When i tried to use the below query i am getting the output as:

|tstats count where index=afg-juhb-appl host_ip=* source=* TERM(offer) by host_ip

host_ip	count
11.56.67.12	45
11.56.67.14	56

But i am not expecting this output.

[richgalloway · Accepted solution]

I should have included source in the by clause.  Then you can use the xyseries command to rearrange the table.

|tstats count where index=afg-juhb-appl host_ip=* source=* TERM(offer) by source, host_ip
| xyseries source host_ip count

[Vani_26]

Thank you @richgalloway  it worked