https://community.splunk.com/t5/Splunk-Search/How-to-view-percentages-in-column-chart-instead-of-total-values/m-p/163749#M46519 <P>Calculating that in search isn't hard though:</P> <PRE><CODE>index=_internal | timechart count by sourcetype | addtotals fieldname=_Total | foreach * [eval &lt;&lt;FIELD&gt;&gt; = '&lt;&lt;FIELD&gt;&gt;' * 100 / _Total] | fields - _Total </CODE></PRE> <P>You can move the <CODE>addtotals | foreach | fields</CODE> into a macro and reuse it.</P> Fri, 01 Aug 2014 21:51:07 GMT martin_mueller 2014-08-01T21:51:07Z https://community.splunk.com/t5/Splunk-Search/How-to-view-percentages-in-column-chart-instead-of-total-values/m-p/163747#M46517 <P>Hi,</P> <P>I'm using a column visualization and the stack mode "100%". It would be nice to have the percentages in the chart instead of total values. Is this possible without calculating the percentages in the search?</P> <P>BR</P> <P>Heinz</P> Wed, 30 Jul 2014 14:51:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-view-percentages-in-column-chart-instead-of-total-values/m-p/163747#M46517 HeinzWaescher 2014-07-30T14:51:07Z https://community.splunk.com/t5/Splunk-Search/How-to-view-percentages-in-column-chart-instead-of-total-values/m-p/163748#M46518 <P>I don't think so.</P> Fri, 01 Aug 2014 21:40:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-view-percentages-in-column-chart-instead-of-total-values/m-p/163748#M46518 martin_mueller 2014-08-01T21:40:00Z https://community.splunk.com/t5/Splunk-Search/How-to-view-percentages-in-column-chart-instead-of-total-values/m-p/163749#M46519 <P>Calculating that in search isn't hard though:</P> <PRE><CODE>index=_internal | timechart count by sourcetype | addtotals fieldname=_Total | foreach * [eval &lt;&lt;FIELD&gt;&gt; = '&lt;&lt;FIELD&gt;&gt;' * 100 / _Total] | fields - _Total </CODE></PRE> <P>You can move the <CODE>addtotals | foreach | fields</CODE> into a macro and reuse it.</P> Fri, 01 Aug 2014 21:51:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-view-percentages-in-column-chart-instead-of-total-values/m-p/163749#M46519 martin_mueller 2014-08-01T21:51:07Z https://community.splunk.com/t5/Splunk-Search/How-to-view-percentages-in-column-chart-instead-of-total-values/m-p/163750#M46520 <P>Awesome, didn't know it can be done so easy. Thanks!</P> Mon, 04 Aug 2014 08:37:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-view-percentages-in-column-chart-instead-of-total-values/m-p/163750#M46520 HeinzWaescher 2014-08-04T08:37:07Z