I rewrote this last night, updated version attached.  I have NOT updated the ZenPack page, as this version has some siginficant changes in structure that may break existing installations?  [This version returns all severity counts with a single call to the shell script.]

I have requested some feedback on that from someone smarter than me before commiting any changes to the zenpack page.

I competely uninstalled my existing zenpack and reinstalled from this file and it worked properly.  The template for graphing events for a single device needs to be bound to devices before it will begin working.  The template for all events is configured to be bound to "Sever/Linux/localhost", I'm unsure if this is the best way to do this, but when I bind it to /Server/Linux it tries to run against all of my linux devices.  I imagine I am doing something wrong there... but haven't figured out what yet.

[Edit 2/25 : Uploaded new version of zenpack without the path typo. ]

Yes, I just found this as well a bit ago.  The path to the shell script should have an underscore:

${here/ZenPackManager/packs/ZenPacks.community.Event_Histograms/path}/libexec/query_all.sh

Same goes for the Device Events template.  Sorry, been hectic today and haven't had time to write up and resubmit the change.  :-P

I'm continuing tuning on this ZenPack, I've got it down to 1 query:

SELECT severity, COUNT(severity) FROM history GROUP BY severity UNION ALL SELECT severity, COUNT(severity) FROM status GROUP BY severity;

I'll get the timestamps in there and the parsing for the different severities soon.

SQL is fun.

 
mysql> SELECT severity, COUNT(severity) FROM history WHERE lastTime>(UNIX_TIMESTAMP(DATE_SUB(NOW(), INTERVAL 5 MINUTE))) GROUP BY severity UNION ALL SELECT severity, COUNT(severity) FROM status WHERE lastTime>(UNIX_TIMESTAMP(DATE_SUB(NOW(), INTERVAL 5 MINUTE))) GROUP BY severity;
 
+----------+-----------------+
| severity | COUNT(severity) |
+----------+-----------------+
|        2 |              28 |
|        3 |              24 |
|        4 |             106 |
|        5 |              20 |
|        4 |              11 |
+----------+-----------------+
5 rows in set (0.00 sec)

I'm selecting from both the status and history tables, everything for the last 5 minutes and then summing in the Python wrapper.  I've converted the bash script to Python and doing a little more tuning.  Going to get this down to 1 Python script with 1 MySQL call.