https://community.splunk.com/t5/Splunk-Search/Percent-timechart/m-p/315066#M163671 <P>Just add an eval statement with your desired calculation, like this</P> <PRE><CODE>index=app sourcetype="someSource" | timechart count(method) as TotalItems, count(Mismatch) as Mismatches | eval PercentMismtach=round(Mismatches*100/TotalItems,2) </CODE></PRE> Fri, 12 Jan 2018 22:01:22 GMT somesoni2 2018-01-12T22:01:22Z https://community.splunk.com/t5/Splunk-Search/Percent-timechart/m-p/315065#M163670 <P>I'm currently using this query to display a chart with two lines: the TotalItems and the number of Mismatches.</P> <PRE><CODE>index=app sourcetype="someSource" | timechart count(method) as TotalItems, count(Mismatch) as Mismatches </CODE></PRE> <P>I need to display the percent of mismatches (mismatches*100/totalItems) of the two lines. Any tips would be really appreciated.</P> Fri, 12 Jan 2018 21:55:53 GMT https://community.splunk.com/t5/Splunk-Search/Percent-timechart/m-p/315065#M163670 Camilleri 2018-01-12T21:55:53Z https://community.splunk.com/t5/Splunk-Search/Percent-timechart/m-p/315066#M163671 <P>Just add an eval statement with your desired calculation, like this</P> <PRE><CODE>index=app sourcetype="someSource" | timechart count(method) as TotalItems, count(Mismatch) as Mismatches | eval PercentMismtach=round(Mismatches*100/TotalItems,2) </CODE></PRE> Fri, 12 Jan 2018 22:01:22 GMT https://community.splunk.com/t5/Splunk-Search/Percent-timechart/m-p/315066#M163671 somesoni2 2018-01-12T22:01:22Z https://community.splunk.com/t5/Splunk-Search/Percent-timechart/m-p/315067#M163672 <P>Thank you!</P> Fri, 12 Jan 2018 22:06:10 GMT https://community.splunk.com/t5/Splunk-Search/Percent-timechart/m-p/315067#M163672 Camilleri 2018-01-12T22:06:10Z