I have 2 indexes:
Both have the same field ticket. When a ticket is reported, it goes in both indexes, but when that ticket is resolved, it just gets removed from fixed index.
Now I wanted to compare how many tickets where there before January and how many are still remaining and plot them on a graph.
It should give output as:
and plot this on a graph.
Try this base search:
index=report OR index=fixed | stats dc(index) AS Indices values(*) AS * by index
From there you can add any
where indices ... clause that you like followed by another
eventstats) clause to wrap it up.