topic Re: How to create a stacked column chart with count(_time) split by index (_internal, main) for each host? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-create-a-stacked-column-chart-with-count-time-split-by/m-p/266453#M80091 <P>It is easy if you use <CODE>chart</CODE> instead <CODE>stats</CODE>:</P> <PRE><CODE>index=_internal OR index=main | chart count over host by index </CODE></PRE> <P>The key difference is that this turns one set of field values into columns instead of rows.</P> Wed, 07 Oct 2015 21:06:57 GMT martin_mueller 2015-10-07T21:06:57Z How to create a stacked column chart with count(_time) split by index (_internal, main) for each host? https://community.splunk.com/t5/Splunk-Search/How-to-create-a-stacked-column-chart-with-count-time-split-by/m-p/266452#M80090 <P>I don't understand why this should be so difficult....okay, here is my search:</P> <PRE><CODE>host=* index=_internal OR index=main | stats count(_time) by host index </CODE></PRE> <P>This does generate the data I want - for each host, there is a count of number of events in each of the two indexes. I want to split the bar graph by index, and display the count(_time) in each index for each host.</P> <P>So host x should display one bar, split as two colors - one for each index - and each color indicating the number of events in that index. And all of the hosts should comprise the x-axis. So that way I can compare the ratio of fill of each index, for each host.<BR /> I can't find any examples of stacked charts online that help me much. Liked I said, seems like this should be easy....</P> Wed, 07 Oct 2015 20:40:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-stacked-column-chart-with-count-time-split-by/m-p/266452#M80090 gsawyer1 2015-10-07T20:40:26Z Re: How to create a stacked column chart with count(_time) split by index (_internal, main) for each host? https://community.splunk.com/t5/Splunk-Search/How-to-create-a-stacked-column-chart-with-count-time-split-by/m-p/266453#M80091 <P>It is easy if you use <CODE>chart</CODE> instead <CODE>stats</CODE>:</P> <PRE><CODE>index=_internal OR index=main | chart count over host by index </CODE></PRE> <P>The key difference is that this turns one set of field values into columns instead of rows.</P> Wed, 07 Oct 2015 21:06:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-stacked-column-chart-with-count-time-split-by/m-p/266453#M80091 martin_mueller 2015-10-07T21:06:57Z