https://community.splunk.com/t5/Splunk-Search/Percentage-Timechart/m-p/30653#M6233 <P>This should do something like what you want;</P> <PRE><CODE>... | timechart span=1m c(eval(HasError=1)) AS err c AS tot | eval err_ratio_perc = round(err/tot*100,0) </CODE></PRE> <P>the round() and multiplication by 100 are not necessary, but produces '16' instead of '0.16000' </P> <P>Hope this helps,</P> <P>Kristian</P> Thu, 09 Aug 2012 22:44:36 GMT kristian_kolb 2012-08-09T22:44:36Z https://community.splunk.com/t5/Splunk-Search/Percentage-Timechart/m-p/30652#M6232 <P>Hi All,</P> <P>I am trying to plot the percentage of "total requests" vs "total errors" and am unfortunately in need of help.</P> <P>I struggled for a good day now, using lots of different methods to do this, im fairly new to Splunk so any help would be appreciated.</P> <P>Ok, simply.... my data can be searched using the below.</P> <P>sourcetype="tcsb_webintel" ServiceName="MCS (Middleware Communication Service)" (AvailableFaresRequestMessage OR GetScheduledAirAvailabilityRequestMessage)</P> <P>This will bring back all requests, all of which have HasError=0 or HasError=1 in the data to signify an error exists with that particular request.</P> <P>i,e if i just wanted all errors i could search for ...<BR /> sourcetype="tcsb_webintel" ServiceName="MCS (Middleware Communication Service)" (AvailableFaresRequestMessage OR GetScheduledAirAvailabilityRequestMessage) HasError=1</P> <P>What i am after is to show the total requests on a timechart, along with the percentage those requests that had errors.</P> <P>I wont post what i have tried already as i have tried a few different ways, appending searches, using eval etc, none of which i could bend to my will. </P> <P>i would greatly appreciate any assistance or guidance in the correct way to approach this....</P> <P>Thanks<BR /> Paul</P> Thu, 09 Aug 2012 15:48:38 GMT https://community.splunk.com/t5/Splunk-Search/Percentage-Timechart/m-p/30652#M6232 paulf 2012-08-09T15:48:38Z https://community.splunk.com/t5/Splunk-Search/Percentage-Timechart/m-p/30653#M6233 <P>This should do something like what you want;</P> <PRE><CODE>... | timechart span=1m c(eval(HasError=1)) AS err c AS tot | eval err_ratio_perc = round(err/tot*100,0) </CODE></PRE> <P>the round() and multiplication by 100 are not necessary, but produces '16' instead of '0.16000' </P> <P>Hope this helps,</P> <P>Kristian</P> Thu, 09 Aug 2012 22:44:36 GMT https://community.splunk.com/t5/Splunk-Search/Percentage-Timechart/m-p/30653#M6233 kristian_kolb 2012-08-09T22:44:36Z