actually the last method is likely to be faster than using multireport. Multireport doesn't attempt to ask the indexers to pre-compute intermediate aggregates for the reports, which will make a big difference for data that is distributed across many indexers.
another method for doing this is by appending an "ALL" value to each DestinationIP and HTTPStatus. E.g.
sourcetype=myhttpdata | eval DestinationIP = mvappend(DestinationIP,"ALL") | eval HTTPStatus=mvappend(HTTPStatus,"ALL") | stats count by SourceIP DestinationIP HTTPStatus
This has the additional benefit that if for some reason there are events that have a SourceIP but no DestinationIP or HTTPStatus, it will still get counted in the total for that SourceIP
... View more