https://community.splunk.com/t5/Splunk-Search/chart-percentage-over-a-timeframe/m-p/131924#M35982 <P>Try something like this:</P> <PRE><CODE>sourcetype=your_data | bin span=1h _time | stats count by _time cipher | eventstats sum(count) as Total by _time | eval perc = count / Total * 100 | xyseries _time cipher perc </CODE></PRE> <P>That's assuming the cipher name is extracted in field <CODE>cipher</CODE>.</P> Mon, 07 Jul 2014 10:14:10 GMT martin_mueller 2014-07-07T10:14:10Z https://community.splunk.com/t5/Splunk-Search/chart-percentage-over-a-timeframe/m-p/131923#M35981 <P>I have a webserver log with one entry per request. Every entry contains the used cipher. I want to generate a chart over the last days how many requests used cipher X as percentage of all requests for every hour in the timeframe.<BR /> It's no problem to select the right entries, but I'm not able to generate the chart. <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span> Every help is appreciated. </P> Mon, 07 Jul 2014 09:35:31 GMT https://community.splunk.com/t5/Splunk-Search/chart-percentage-over-a-timeframe/m-p/131923#M35981 charles981 2014-07-07T09:35:31Z https://community.splunk.com/t5/Splunk-Search/chart-percentage-over-a-timeframe/m-p/131924#M35982 <P>Try something like this:</P> <PRE><CODE>sourcetype=your_data | bin span=1h _time | stats count by _time cipher | eventstats sum(count) as Total by _time | eval perc = count / Total * 100 | xyseries _time cipher perc </CODE></PRE> <P>That's assuming the cipher name is extracted in field <CODE>cipher</CODE>.</P> Mon, 07 Jul 2014 10:14:10 GMT https://community.splunk.com/t5/Splunk-Search/chart-percentage-over-a-timeframe/m-p/131924#M35982 martin_mueller 2014-07-07T10:14:10Z https://community.splunk.com/t5/Splunk-Search/chart-percentage-over-a-timeframe/m-p/131925#M35983 <P>Thanks a lot. Thats what I need!</P> Mon, 07 Jul 2014 11:28:40 GMT https://community.splunk.com/t5/Splunk-Search/chart-percentage-over-a-timeframe/m-p/131925#M35983 charles981 2014-07-07T11:28:40Z