I'm currently searching all of my jboss.out logs for SQLState. How can I break out the results with number of errors per host instead of a combined value? It'd be great if I can also have a graph created that's an overlay type which visualizes how many of those errors per host on top of each other for the same time period. Below is the query I have so far:
index="itdev" host="xxxxx*" source="/var/log/jboss/jboss.out" "SQLState" | sort - count
index="itdev" host="xxxxx*" source="/var/log/jboss/jboss.out" "SQLState" | stats count by host
index="itdev" host="xxxxx*" source="/var/log/jboss/jboss.out" "SQLState" | stats count by host
And for the graph:
index="itdev" host="xxxxx*" source="/var/log/jboss/jboss.out" "SQLState" | timechart count by host
Put them together in a dashboard, maybe