Your base search will be specific to your environment (i.e. Windows Event codes, ssh login messages, etc), but if you get your base search, you can than do something like:
"yoursearch" | chart count over user by host
Again, it will depend on your source data. If you give a bit more info (sourcetypes, etc), be happy to respond.
@lllidan,
can you share more information about events or provide sample event?