https://community.splunk.com/t5/Splunk-Search/How-to-get-percentage-in-stats-instead-of-count/m-p/429778#M122903 <P>@zacksoft<BR /> Yes, we can eval one more filed <CODE>Bucket</CODE>. For this sample data and expected output will be appreciated. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> </P> Tue, 30 Apr 2019 09:40:07 GMT kamlesh_vaghela 2019-04-30T09:40:07Z https://community.splunk.com/t5/Splunk-Search/How-to-get-percentage-in-stats-instead-of-count/m-p/429775#M122900 <P>I am calculating number of web-calls that were served in certain seconds.<BR /> | stats count(web-calls) as web-call-count by server_response.</P> <P>So, in x axis I see the seconds, and Y axis i see the number of web-calls ..in a column chart.<BR /> What we are looking for is, "Can we get the percentage of web-calls instead of count in Y-axis" ?</P> Tue, 30 Apr 2019 08:27:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-percentage-in-stats-instead-of-count/m-p/429775#M122900 zacksoft 2019-04-30T08:27:33Z https://community.splunk.com/t5/Splunk-Search/How-to-get-percentage-in-stats-instead-of-count/m-p/429776#M122901 <P>@zacksoft </P> <P>Can you please try this?</P> <PRE><CODE>YOUR_SEARCH | stats count(web-calls) as web-call-count by server_response | eventstats sum(web-call-count) as total | eval percentage=round((web-call-count*100/total),2) | table server_response percentage </CODE></PRE> Tue, 30 Apr 2019 09:13:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-percentage-in-stats-instead-of-count/m-p/429776#M122901 kamlesh_vaghela 2019-04-30T09:13:56Z https://community.splunk.com/t5/Splunk-Search/How-to-get-percentage-in-stats-instead-of-count/m-p/429777#M122902 <P>The command works perfectly. Thank you... <BR /> If I may add one more thing, Is it possible to create buckets ..say something like 3 buckets.<BR /> Bucket 1 showing the percentage of web-calls whose response were less than a second. <BR /> Bucket 2 showing percentage of web-calls ...between 1 to 10 sec.<BR /> Bucket 3 showing ..more tan 10 sec..</P> <P>May be in a column chart showing three columns as three buckets or any other way..we can visualize ???</P> Tue, 30 Apr 2019 09:32:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-percentage-in-stats-instead-of-count/m-p/429777#M122902 zacksoft 2019-04-30T09:32:24Z https://community.splunk.com/t5/Splunk-Search/How-to-get-percentage-in-stats-instead-of-count/m-p/429778#M122903 <P>@zacksoft<BR /> Yes, we can eval one more filed <CODE>Bucket</CODE>. For this sample data and expected output will be appreciated. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> </P> Tue, 30 Apr 2019 09:40:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-percentage-in-stats-instead-of-count/m-p/429778#M122903 kamlesh_vaghela 2019-04-30T09:40:07Z https://community.splunk.com/t5/Splunk-Search/How-to-get-percentage-in-stats-instead-of-count/m-p/429779#M122904 <P>I have put some sample data here along with more description<BR /> <A href="https://answers.splunk.com/answers/742026/creating-buckets-based-a-percentage-of-occurrence.html?minQuestionBodyLength=80">https://answers.splunk.com/answers/742026/creating-buckets-based-a-percentage-of-occurrence.html?minQuestionBodyLength=80</A></P> Tue, 30 Apr 2019 09:56:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-percentage-in-stats-instead-of-count/m-p/429779#M122904 zacksoft 2019-04-30T09:56:44Z