Search basics
index, sourcetype, and a transforming command.
index=main sourcetype=linux_secure failed
| stats count by user, src_ip
| sort -countStart narrow: index, time range, then a literal or a field. stats, timechart, and table turn events into answers. If a search is slow, you are probably scanning too much time or the wrong index — fix that before you add more pipes.