I am trying to perform a search of the number of failed login event codes but have it summarized by the host and the account ID within the host. I can get the counts by host and the counts by account ID but I need them grouped by both fields. Is this possible.
if you want the detail per host and account id :
< mysearchtofindloginerrors > | stats count by host account