Grouping search results
The from command also supports aggregation using the GROUP BY clause in conjunction with aggregate functions calls in the SELECT clause like this:
FROM main WHERE earliest=-5m@m AND latest=@m GROUP BY host SELECT sum(bytes) AS sum, host
Next step
See Filtering data.