How to augment |top output with additional searches/results?

[lensammus]

I'd like to combine/add/include the results of a search to each item of a top 10 search

for data like:
msg="error asdf" host=server1
msg="error zxcv" host=server1
msg="error qwer" host=server2
msg="error zxcv" host=server2
msg="error zxcv" host=server2

I'd like to end up with output like:
(A top 10 of the msg's found, and then the top hosts in another colum per msg, ideally with a count of both msg's and hosts per msg)

Columns: [msg], [total msg count], [hosts sorted by count, and with :count if possible]
error zxcv, 3, server2:2 server1:1
error asdf, 1, server1:1
error qwer, 1, server2:1

I wouldn't care if the hosts and counts got their own line like a values() or having to do a dashboard with a query per top msg (although I'm not sure how to specify the non first result of a | top command either)

Anyway, this lets me know where my errors are, and which servers are having more of them and an idea of how many, which cuts out a step in investigation and makes much more useful externally facing reports

I can get close for the first row with a subsearch and a value() but the data returned only applies to row 1's msg value
Programmaticly it would be something like, for each of the top 10 errors, print the hosts that match the msg field in order and with a count

[lguinn2 · Accepted solution]

Try this

yoursearchhere
| top host by msg | eventstats sum(count) as msgtotal by msg 
| sort -msgtotal -count 
| stats first(msgtotal) as "Total Message Count" list(host) as "Top Hosts" list(count) as "Top Message Counts by Host" by msg