I don't understand why this should be so difficult....okay, here is my search:
host=* index=_internal OR index=main | stats count(_time) by host index
This does generate the data I want - for each host, there is a count of number of events in each of the two indexes. I want to split the bar graph by index, and display the count(_time) in each index for each host.
So host x should display one bar, split as two colors - one for each index - and each color indicating the number of events in that index. And all of the hosts should comprise the x-axis. So that way I can compare the ratio of fill of each index, for each host.
I can't find any examples of stacked charts online that help me much. Liked I said, seems like this should be easy....
It is easy if you use chart
instead stats
:
index=_internal OR index=main | chart count over host by index
The key difference is that this turns one set of field values into columns instead of rows.