<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: % of total in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/of-total/m-p/552539#M38269</link>
    <description>&lt;P&gt;I got your point on the ISNULL. Sorry I missed that part.&lt;/P&gt;&lt;P&gt;But the result is giving me extra columns which i dont want&lt;/P&gt;&lt;P&gt;A B C Percentage_A Percentage_B Percentage_C Percentage_Total Total&lt;/P&gt;&lt;TABLE&gt;&lt;TBODY&gt;&lt;TR&gt;&lt;TD&gt;76&lt;/TD&gt;&lt;TD&gt;68&lt;/TD&gt;&lt;TD&gt;2886&lt;/TD&gt;&lt;TD&gt;2.5082508250825084&lt;/TD&gt;&lt;TD&gt;2.2442244224422443&lt;/TD&gt;&lt;TD&gt;95.24752475247524&lt;/TD&gt;&lt;TD&gt;100&lt;/TD&gt;&lt;TD&gt;3030&lt;/TD&gt;&lt;/TR&gt;&lt;/TBODY&gt;&lt;/TABLE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;I just want to keep the percentage values&amp;nbsp;&lt;/P&gt;&lt;P&gt;Percentage_A Percentage_B Percentage_C&lt;/P&gt;&lt;TABLE&gt;&lt;TBODY&gt;&lt;TR&gt;&lt;TD&gt;2.5082508250825084&lt;/TD&gt;&lt;TD&gt;2.2442244224422443&lt;/TD&gt;&lt;TD&gt;95.24752475247524&lt;/TD&gt;&lt;/TR&gt;&lt;/TBODY&gt;&lt;/TABLE&gt;</description>
    <pubDate>Fri, 21 May 2021 09:15:10 GMT</pubDate>
    <dc:creator>schou87</dc:creator>
    <dc:date>2021-05-21T09:15:10Z</dc:date>
    <item>
      <title>% of total</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/of-total/m-p/552389#M38248</link>
      <description>&lt;P&gt;hi I have a table as shown below. I want to get the % of total for each status for previous 6 days. How do i write a query to get the same.&lt;/P&gt;&lt;TABLE border="1" width="100%"&gt;&lt;TBODY&gt;&lt;TR&gt;&lt;TD width="25%" height="24px"&gt;DATE&lt;/TD&gt;&lt;TD width="25%" height="24px"&gt;Status_1&lt;/TD&gt;&lt;TD width="25%" height="24px"&gt;Status_2&lt;/TD&gt;&lt;TD width="25%" height="24px"&gt;Status_3&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD width="25%" height="24px"&gt;&lt;SPAN&gt;2021-05-19&lt;/SPAN&gt;&lt;/TD&gt;&lt;TD width="25%" height="24px"&gt;14&lt;/TD&gt;&lt;TD width="25%" height="24px"&gt;33&lt;/TD&gt;&lt;TD width="25%" height="24px"&gt;123&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD width="25%" height="24px"&gt;&lt;SPAN&gt;2021-05-18&lt;/SPAN&gt;&lt;/TD&gt;&lt;TD width="25%" height="24px"&gt;45&lt;/TD&gt;&lt;TD width="25%" height="24px"&gt;12&lt;/TD&gt;&lt;TD width="25%" height="24px"&gt;456&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD width="25%" height="24px"&gt;&lt;SPAN&gt;2021-05-17&lt;/SPAN&gt;&lt;/TD&gt;&lt;TD width="25%" height="24px"&gt;4&lt;/TD&gt;&lt;TD width="25%" height="24px"&gt;6&lt;/TD&gt;&lt;TD width="25%" height="24px"&gt;213&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD width="25%" height="24px"&gt;&lt;SPAN&gt;2021-05-16&lt;/SPAN&gt;&lt;/TD&gt;&lt;TD width="25%" height="24px"&gt;5&lt;/TD&gt;&lt;TD width="25%" height="24px"&gt;8&lt;/TD&gt;&lt;TD width="25%" height="24px"&gt;564&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD width="25%" height="24px"&gt;&lt;SPAN&gt;2021-05-15&lt;/SPAN&gt;&lt;/TD&gt;&lt;TD width="25%" height="24px"&gt;4&lt;/TD&gt;&lt;TD width="25%" height="24px"&gt;9&lt;/TD&gt;&lt;TD width="25%" height="24px"&gt;987&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD width="25%" height="24px"&gt;&lt;SPAN&gt;2021-05-14&lt;/SPAN&gt;&lt;/TD&gt;&lt;TD width="25%" height="24px"&gt;4&lt;/TD&gt;&lt;TD width="25%" height="24px"&gt;0&lt;/TD&gt;&lt;TD width="25%" height="24px"&gt;543&lt;/TD&gt;&lt;/TR&gt;&lt;/TBODY&gt;&lt;/TABLE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Thu, 20 May 2021 13:01:22 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/of-total/m-p/552389#M38248</guid>
      <dc:creator>schou87</dc:creator>
      <dc:date>2021-05-20T13:01:22Z</dc:date>
    </item>
    <item>
      <title>Re: % of total</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/of-total/m-p/552393#M38250</link>
      <description>&lt;LI-CODE lang="markup"&gt;| eventstats sum(Status_*) as Total_*
| foreach Status_*
    [| eval Percentage_&amp;lt;&amp;lt;MATCHSTR&amp;gt;&amp;gt;=100*&amp;lt;&amp;lt;FIELD&amp;gt;&amp;gt;/Total_&amp;lt;&amp;lt;MATCHSTR&amp;gt;&amp;gt;]&lt;/LI-CODE&gt;</description>
      <pubDate>Thu, 20 May 2021 13:14:20 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/of-total/m-p/552393#M38250</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2021-05-20T13:14:20Z</dc:date>
    </item>
    <item>
      <title>Re: % of total</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/of-total/m-p/552394#M38251</link>
      <description>&lt;P&gt;Hi,&lt;/P&gt;&lt;P&gt;I am getting an error&amp;nbsp; : Unencoded &amp;lt;&lt;/P&gt;&lt;P&gt;Also, can we please consider the below:&lt;/P&gt;&lt;P&gt;Status_1: A&lt;/P&gt;&lt;P&gt;Status_2: B&lt;/P&gt;&lt;P&gt;Status_3: C&lt;/P&gt;&lt;P&gt;I don't want to use matchstring as there is no wildcard match in my example. That was just an example.&lt;/P&gt;</description>
      <pubDate>Thu, 20 May 2021 13:25:31 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/of-total/m-p/552394#M38251</guid>
      <dc:creator>schou87</dc:creator>
      <dc:date>2021-05-20T13:25:31Z</dc:date>
    </item>
    <item>
      <title>Re: % of total</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/of-total/m-p/552511#M38260</link>
      <description>&lt;LI-CODE lang="markup"&gt;| makeresults 
| eval _raw="DATE	A	B	C
2021-05-19	14	33	123
2021-05-18	45	12	456
2021-05-17	4	6	213
2021-05-16	5	8	564
2021-05-15	4	9	987
2021-05-14	4	0	543"
| multikv forceheader=1
| fields - _raw linecount
| eval _time=DATE
| fields - DATE
| eventstats sum(*) as Total_*
| foreach *
    [| eval Percentage_&amp;lt;&amp;lt;FIELD&amp;gt;&amp;gt;=100*&amp;lt;&amp;lt;FIELD&amp;gt;&amp;gt;/Total_&amp;lt;&amp;lt;FIELD&amp;gt;&amp;gt;]
| rename _time as DATE&lt;/LI-CODE&gt;</description>
      <pubDate>Fri, 21 May 2021 06:55:52 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/of-total/m-p/552511#M38260</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2021-05-21T06:55:52Z</dc:date>
    </item>
    <item>
      <title>Re: % of total</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/of-total/m-p/552527#M38261</link>
      <description>&lt;P&gt;Hi, your query gives me % total for each field individually on daily basis but can you tell me how to do a % of total for previous 6 days together and not calculate day on day basis. So I just want to return 3 rows for % total of my 3 fields.&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Like % A=&amp;nbsp; A/A+B+C *100 ( for all 6 days together and not by individual dates)&lt;/P&gt;</description>
      <pubDate>Fri, 21 May 2021 08:05:47 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/of-total/m-p/552527#M38261</guid>
      <dc:creator>schou87</dc:creator>
      <dc:date>2021-05-21T08:05:47Z</dc:date>
    </item>
    <item>
      <title>Re: % of total</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/of-total/m-p/552528#M38262</link>
      <description>&lt;LI-CODE lang="markup"&gt;| makeresults 
| eval _raw="DATE	A	B	C
2021-05-19	14	33	123
2021-05-18	45	12	456
2021-05-17	4	6	213
2021-05-16	5	8	564
2021-05-15	4	9	987
2021-05-14	4	0	543"
| multikv forceheader=1
| fields - _raw linecount
| eval _time=DATE
| fields - DATE
| addtotals
| stats sum(*) as *
| foreach *
    [| eval Percentage_&amp;lt;&amp;lt;FIELD&amp;gt;&amp;gt;=100*&amp;lt;&amp;lt;FIELD&amp;gt;&amp;gt;/Total]&lt;/LI-CODE&gt;&lt;P&gt;You can remove Percentage_Total as this will always be 100&lt;/P&gt;</description>
      <pubDate>Fri, 21 May 2021 08:13:44 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/of-total/m-p/552528#M38262</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2021-05-21T08:13:44Z</dc:date>
    </item>
    <item>
      <title>Re: % of total</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/of-total/m-p/552530#M38263</link>
      <description>&lt;P&gt;Alternatively&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| makeresults 
| eval _raw="DATE	A	B	C
2021-05-19	14	33	123
2021-05-18	45	12	456
2021-05-17	4	6	213
2021-05-16	5	8	564
2021-05-15	4	9	987
2021-05-14	4	0	543"
| multikv forceheader=1
| fields - _raw linecount
| eval _time=DATE
| fields - DATE
| addcoltotals 
| addtotals
| foreach *
    [| eval Percentage_&amp;lt;&amp;lt;FIELD&amp;gt;&amp;gt;=100*&amp;lt;&amp;lt;FIELD&amp;gt;&amp;gt;/Total]
| where isnull(_time)
| fields - _time&lt;/LI-CODE&gt;</description>
      <pubDate>Fri, 21 May 2021 08:18:12 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/of-total/m-p/552530#M38263</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2021-05-21T08:18:12Z</dc:date>
    </item>
    <item>
      <title>Re: % of total</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/of-total/m-p/552534#M38265</link>
      <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168"&gt;@ITWhisperer&lt;/a&gt;&amp;nbsp;, thanks for that!! But it is returning 8 rows where i just want below (numbers are hypothetical)&lt;/P&gt;&lt;P&gt;A&amp;nbsp; &amp;nbsp; 96.51&lt;/P&gt;&lt;P&gt;B&amp;nbsp; &amp;nbsp; &amp;nbsp;3.43&lt;/P&gt;&lt;P&gt;C&amp;nbsp; &amp;nbsp; &amp;nbsp;0.05&lt;/P&gt;</description>
      <pubDate>Fri, 21 May 2021 08:32:10 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/of-total/m-p/552534#M38265</guid>
      <dc:creator>schou87</dc:creator>
      <dc:date>2021-05-21T08:32:10Z</dc:date>
    </item>
    <item>
      <title>Re: % of total</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/of-total/m-p/552536#M38267</link>
      <description>&lt;P&gt;8 rows? There should only be one row where the date is null - this is the row generated by the addcoltotals - if you want to be more specific you could do this&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| makeresults 
| eval _raw="DATE	A	B	C
2021-05-19	14	33	123
2021-05-18	45	12	456
2021-05-17	4	6	213
2021-05-16	5	8	564
2021-05-15	4	9	987
2021-05-14	4	0	543"
| multikv forceheader=1
| fields - _* linecount
| fields - DATE
| addtotals
| addcoltotals labelfield=Result label=Total
| foreach *
    [| eval Percentage_&amp;lt;&amp;lt;FIELD&amp;gt;&amp;gt;=100*&amp;lt;&amp;lt;FIELD&amp;gt;&amp;gt;/Total]
| where Result="Total"&lt;/LI-CODE&gt;</description>
      <pubDate>Fri, 21 May 2021 08:43:35 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/of-total/m-p/552536#M38267</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2021-05-21T08:43:35Z</dc:date>
    </item>
    <item>
      <title>Re: % of total</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/of-total/m-p/552539#M38269</link>
      <description>&lt;P&gt;I got your point on the ISNULL. Sorry I missed that part.&lt;/P&gt;&lt;P&gt;But the result is giving me extra columns which i dont want&lt;/P&gt;&lt;P&gt;A B C Percentage_A Percentage_B Percentage_C Percentage_Total Total&lt;/P&gt;&lt;TABLE&gt;&lt;TBODY&gt;&lt;TR&gt;&lt;TD&gt;76&lt;/TD&gt;&lt;TD&gt;68&lt;/TD&gt;&lt;TD&gt;2886&lt;/TD&gt;&lt;TD&gt;2.5082508250825084&lt;/TD&gt;&lt;TD&gt;2.2442244224422443&lt;/TD&gt;&lt;TD&gt;95.24752475247524&lt;/TD&gt;&lt;TD&gt;100&lt;/TD&gt;&lt;TD&gt;3030&lt;/TD&gt;&lt;/TR&gt;&lt;/TBODY&gt;&lt;/TABLE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;I just want to keep the percentage values&amp;nbsp;&lt;/P&gt;&lt;P&gt;Percentage_A Percentage_B Percentage_C&lt;/P&gt;&lt;TABLE&gt;&lt;TBODY&gt;&lt;TR&gt;&lt;TD&gt;2.5082508250825084&lt;/TD&gt;&lt;TD&gt;2.2442244224422443&lt;/TD&gt;&lt;TD&gt;95.24752475247524&lt;/TD&gt;&lt;/TR&gt;&lt;/TBODY&gt;&lt;/TABLE&gt;</description>
      <pubDate>Fri, 21 May 2021 09:15:10 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/of-total/m-p/552539#M38269</guid>
      <dc:creator>schou87</dc:creator>
      <dc:date>2021-05-21T09:15:10Z</dc:date>
    </item>
    <item>
      <title>Re: % of total</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/of-total/m-p/552540#M38270</link>
      <description>&lt;LI-CODE lang="markup"&gt;| makeresults 
| eval _raw="DATE	A	B	C
2021-05-19	14	33	123
2021-05-18	45	12	456
2021-05-17	4	6	213
2021-05-16	5	8	564
2021-05-15	4	9	987
2021-05-14	4	0	543"
| multikv forceheader=1
| fields - _* linecount
| fields - DATE
| addtotals
| addcoltotals labelfield=Result label=Total
| foreach *
    [| eval Percentage_&amp;lt;&amp;lt;FIELD&amp;gt;&amp;gt;=100*&amp;lt;&amp;lt;FIELD&amp;gt;&amp;gt;/Total]
| where Result="Total"
| fields - Percentage_Total
| fields Percentage_*&lt;/LI-CODE&gt;</description>
      <pubDate>Fri, 21 May 2021 09:23:24 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/of-total/m-p/552540#M38270</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2021-05-21T09:23:24Z</dc:date>
    </item>
    <item>
      <title>Re: % of total</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/of-total/m-p/552557#M38271</link>
      <description>&lt;P&gt;Awesome!! Thank you &lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168"&gt;@ITWhisperer&lt;/a&gt;&amp;nbsp;for your patience with me. &lt;span class="lia-unicode-emoji" title=":slightly_smiling_face:"&gt;🙂&lt;/span&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Fri, 21 May 2021 12:36:49 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/of-total/m-p/552557#M38271</guid>
      <dc:creator>schou87</dc:creator>
      <dc:date>2021-05-21T12:36:49Z</dc:date>
    </item>
  </channel>
</rss>

