How to show count of events by host as well as total count (both per minute in same search)
This query will accomplish that request:
| tstats count by _time span=1m host | eventstats sum(count) as Total by _time
