This is an excellent solution...works just fine.
Added a few modifications in an attempt to show the date the messages were received for the past year. (Results will depend on data retention settings for Syslog)
SELECT DateTime AS DateTime, Hostname, SUBSTRING(Message, CHARINDEX('putting ', Message) + 7, len(Message)) AS Expr1, count(messagetype) as Count
FROM Syslog
WHERE DateTime >= dateadd(year,-1,getdate())and DateTime <= getdate()
and messagetype = 'PM-4-ERR_DISABLE'
group by datetime, hostname, messagetype, message order by count(messagetype) desc