https://community.splunk.com/t5/Splunk-Search/How-to-get-percentage-of-200-responses/m-p/634584#M220456 <P>sorry the first answer was correct,&nbsp; this is a different issue<BR /><BR />heres my query&nbsp;index="intau_workfusion" host=* "crash" | chart count by host status<BR /><BR />so I want to be able to display a zero if a host returns no results</P> Wed, 15 Mar 2023 13:18:16 GMT sphiwee 2023-03-15T13:18:16Z https://community.splunk.com/t5/Splunk-Search/How-to-get-percentage-of-200-responses/m-p/634234#M220303 <P>I have current search&nbsp;<BR /><BR />index="intau_workfusion" host=* sourcetype="services_status.out.log" service="HTTP/1.1" status=* | chart count by status</P> <P>&nbsp;</P> <P>when I run it and save as pie chart I am able to get the percentage of the different status code status's, but I want it in table format and I cant divide by total when doing my eval status as all the other status codes still fall under "status" how can I solve this?</P> Mon, 13 Mar 2023 13:53:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-percentage-of-200-responses/m-p/634234#M220303 sphiwee 2023-03-13T13:53:56Z https://community.splunk.com/t5/Splunk-Search/How-to-get-percentage-of-200-responses/m-p/634237#M220305 <LI-CODE lang="markup">| chart count by status | eventstats sum(count) as total | eval percent=100*count/total</LI-CODE> Mon, 13 Mar 2023 10:22:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-percentage-of-200-responses/m-p/634237#M220305 ITWhisperer 2023-03-13T10:22:06Z https://community.splunk.com/t5/Splunk-Search/How-to-get-percentage-of-200-responses/m-p/634565#M220448 <P>thank you it's working, i forgot to mention that it has to display 0 for hosts that do not have any results, ive tried fillnull and its not working</P> Wed, 15 Mar 2023 12:19:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-percentage-of-200-responses/m-p/634565#M220448 sphiwee 2023-03-15T12:19:22Z https://community.splunk.com/t5/Splunk-Search/How-to-get-percentage-of-200-responses/m-p/634569#M220450 <P>OK that puts a different spin on it</P><LI-CODE lang="markup">| chart count by host status | addtotals | eval "200" = 100 * '200'/Total | fields host 200 Total | append [ &lt;search to list all the hosts you are interested in&gt; ] | fillnull value=0 | stats sum(*) as * by host</LI-CODE> Wed, 15 Mar 2023 12:38:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-percentage-of-200-responses/m-p/634569#M220450 ITWhisperer 2023-03-15T12:38:06Z https://community.splunk.com/t5/Splunk-Search/How-to-get-percentage-of-200-responses/m-p/634584#M220456 <P>sorry the first answer was correct,&nbsp; this is a different issue<BR /><BR />heres my query&nbsp;index="intau_workfusion" host=* "crash" | chart count by host status<BR /><BR />so I want to be able to display a zero if a host returns no results</P> Wed, 15 Mar 2023 13:18:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-percentage-of-200-responses/m-p/634584#M220456 sphiwee 2023-03-15T13:18:16Z