https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-by-hour-and-calculate-percentage-for-each-hour/m-p/586981#M204431 <P>what I am basically looking for here is&nbsp;<BR /><BR />_time&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;status&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;count&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; percentage</P><P>12:30.&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;100&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;400.&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 30</P><P>12:30&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 200&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;600&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;60</P><P>12:30&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 300&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;400&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;30</P><P>01:30&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 100&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 100&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;10</P><P>01:30&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 200&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 400&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 45</P><P>01:30&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 300&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 400&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 45</P><P>&nbsp;</P><P>like wise</P> Tue, 01 Mar 2022 11:58:22 GMT bijodev1 2022-03-01T11:58:22Z https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-by-hour-and-calculate-percentage-for-each-hour/m-p/586973#M204426 <P>Hi There,</P> <P>I am trying to get the an hourly stats for each status code and get the percentage for each hour per status. Not sure how to get it.</P> <LI-CODE lang="markup">my search | | bucket _time span=1h | stats count by _time http_status_code | eventstats sum(count) as totalCount | eval percentage=round((count/totalCount),3)*100</LI-CODE> <P>please suggest which command could be helpful here.&nbsp;</P> <P>thanks</P> Tue, 01 Mar 2022 17:31:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-by-hour-and-calculate-percentage-for-each-hour/m-p/586973#M204426 bijodev1 2022-03-01T17:31:21Z https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-by-hour-and-calculate-percentage-for-each-hour/m-p/586974#M204427 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/235142">@bijodev1</a>,</P><P>please try this:</P><LI-CODE lang="markup">my_search | eventstats sum(count) as totalCount | bucket _time span=1h | stats values(totalCount) AS totalCount count BY _time http_status_code | eval percentage=round((count/totalCount),3)*100</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Tue, 01 Mar 2022 11:37:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-by-hour-and-calculate-percentage-for-each-hour/m-p/586974#M204427 gcusello 2022-03-01T11:37:16Z https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-by-hour-and-calculate-percentage-for-each-hour/m-p/586978#M204429 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/161352">@gcusello</a>&nbsp;</P><P>thank you for the response, but didn't got me any output.&nbsp;</P><P>It doesn't show the percentage and total count per hour</P> Tue, 01 Mar 2022 11:53:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-by-hour-and-calculate-percentage-for-each-hour/m-p/586978#M204429 bijodev1 2022-03-01T11:53:46Z https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-by-hour-and-calculate-percentage-for-each-hour/m-p/586981#M204431 <P>what I am basically looking for here is&nbsp;<BR /><BR />_time&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;status&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;count&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; percentage</P><P>12:30.&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;100&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;400.&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 30</P><P>12:30&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 200&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;600&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;60</P><P>12:30&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 300&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;400&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;30</P><P>01:30&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 100&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 100&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;10</P><P>01:30&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 200&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 400&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 45</P><P>01:30&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 300&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 400&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 45</P><P>&nbsp;</P><P>like wise</P> Tue, 01 Mar 2022 11:58:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-by-hour-and-calculate-percentage-for-each-hour/m-p/586981#M204431 bijodev1 2022-03-01T11:58:22Z https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-by-hour-and-calculate-percentage-for-each-hour/m-p/586987#M204433 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/235142">@bijodev1</a>,</P><P>please try this:</P><LI-CODE lang="markup">my_search | eventstats count as totalCount | bucket _time span=1h | stats values(totalCount) AS totalCount count BY _time http_status_code | eval percentage=round((count/totalCount),3)*100</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Tue, 01 Mar 2022 12:37:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-by-hour-and-calculate-percentage-for-each-hour/m-p/586987#M204433 gcusello 2022-03-01T12:37:25Z https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-by-hour-and-calculate-percentage-for-each-hour/m-p/587013#M204444 <P>Give this a try</P><LI-CODE lang="markup">my_search | bucket _time span=1h | stats count BY _time http_status_code | eventstats sum(count) as totalCount by _time | eval percentage=round((count/totalCount),3)*100 | table _time http_status_code count percentage</LI-CODE> Tue, 01 Mar 2022 14:06:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-by-hour-and-calculate-percentage-for-each-hour/m-p/587013#M204444 somesoni2 2022-03-01T14:06:37Z https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-by-hour-and-calculate-percentage-for-each-hour/m-p/587021#M204448 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/15147">@somesoni2</a>&nbsp;thank you for the help, it worked.</P> Tue, 01 Mar 2022 14:38:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-by-hour-and-calculate-percentage-for-each-hour/m-p/587021#M204448 bijodev1 2022-03-01T14:38:09Z