https://community.splunk.com/t5/Splunk-Search/Get-percentage-between-two-graph-lines-over-time/m-p/152084#M42616 <P>I went with the 2nd option as I'm not very familiar with appendcols and it didn't work immediately for me. It said I had to use a chart option instead of a table. But the 2nd option with the join works great. Thank you.</P> Fri, 31 Jul 2015 20:17:56 GMT jizzmaster 2015-07-31T20:17:56Z https://community.splunk.com/t5/Splunk-Search/Get-percentage-between-two-graph-lines-over-time/m-p/152082#M42614 <P>I have two numbers that I am trying to get a percentage out of. One number is a count of total IPs. The other is a count of asset records. I want to know what percentage of total IPs have an asset record. That's "asset/total" for a proportion. Easy enough.</P> <P>Now the part that is stumping me. I summarize the "asset" number and the "total" number each day into a summary index. So I have a running number for each. I would like to have a graph showing the "total" count, the "asset" count, and a new field, "percentage." How can I have Splunk start at 30 days back, compare these two numbers to create a percentage, then do the same things for days 29-1 and make it into a visual graph?</P> <P>Here's my current attempt at doing it for just the most recent summary info. Not sure how to approach the 30 days, though.</P> <PRE><CODE>index=summary source="assets" earliest=-1d |eval proportion=count/[search index=summary source="total" earliest=-1d |return $count] |table proportion </CODE></PRE> Fri, 31 Jul 2015 19:45:09 GMT https://community.splunk.com/t5/Splunk-Search/Get-percentage-between-two-graph-lines-over-time/m-p/152082#M42614 jizzmaster 2015-07-31T19:45:09Z https://community.splunk.com/t5/Splunk-Search/Get-percentage-between-two-graph-lines-over-time/m-p/152083#M42615 <P>Not exactly sure what you data looks like but here are two methods I would use.</P> <PRE><CODE>index=summary source="assets" earliest=-1d | table count | appendcols [search index=summary source="total" earliest=-1| rename count as total | fields total] | eval proportion=count/total | table proportion index=summary source="assets" earliest=-1d | table _time count | join _time [search index=summary source="total" earliest=-1| rename count as total | fields _time total] | eval proportion=count/total | table proportion </CODE></PRE> Fri, 31 Jul 2015 20:04:06 GMT https://community.splunk.com/t5/Splunk-Search/Get-percentage-between-two-graph-lines-over-time/m-p/152083#M42615 bmacias84 2015-07-31T20:04:06Z https://community.splunk.com/t5/Splunk-Search/Get-percentage-between-two-graph-lines-over-time/m-p/152084#M42616 <P>I went with the 2nd option as I'm not very familiar with appendcols and it didn't work immediately for me. It said I had to use a chart option instead of a table. But the 2nd option with the join works great. Thank you.</P> Fri, 31 Jul 2015 20:17:56 GMT https://community.splunk.com/t5/Splunk-Search/Get-percentage-between-two-graph-lines-over-time/m-p/152084#M42616 jizzmaster 2015-07-31T20:17:56Z