topic Re: Timechart usind the percentage field in Splunk Search

Timechart usind the percentage field

duygu — Wed, 27 Jun 2018 10:26:01 GMT

Hi,

I am trying to build a timechart but only using the "percent" field according to the example search below. Can anyone please help me?

Thanks

index=* source=*
| stats values(bytes) as bytes values(clientip) as clientip values(Time) as Time
| chart count OVER bytes
| eventstats sum(count) As total
| eval percent=round((100*count/total),2)

Re: Timechart usind the percentage field

FrankVl — Wed, 27 Jun 2018 12:23:45 GMT

Your example search doesn't make a lot of sense to me.

| stats values(bytes) as bytes values(clientip) as clientip values(Time) as Time
No by-clause, so this will result in a single row result (potentially with multi valued fields)

| chart count OVER bytes
This will result in a single count = 1, given that the previous part of the query was a single row result.

| eventstats sum(count) As total
This will therefore also result in 1.

| eval percent=round((100*count/total),2)
This would make sense if the count and total made sense.

Can you please explain what percentage you want to calculate (and timechart)?

Re: Timechart usind the percentage field

renjith_nair — Wed, 27 Jun 2018 12:49:30 GMT

Hi @duygu,

Are you looking for something like this?

index="your index" source="your source"|timechart span=10m count(bytes)  by clientip 
|addtotals row=true fieldname=_Total|foreach * [eval <<FIELD>> = round(('<<FIELD>>' * 100 / _Total),2)]

change the span and also the aggregation function count according to your requirement

Re: Timechart usind the percentage field

renjith_nair — Wed, 04 Jul 2018 13:21:46 GMT

Hi @duygu, lets know if you still have questions