https://community.splunk.com/t5/Splunk-Search/query-for-percentage-with-count/m-p/225080#M66366 <P>Not sure if I understand what you need? What is the search that you're trying (before the appendpipe) and what is the fieldnames that you see?</P> Thu, 14 Jan 2016 01:08:30 GMT somesoni2 2016-01-14T01:08:30Z https://community.splunk.com/t5/Splunk-Search/query-for-percentage-with-count/m-p/225075#M66361 <P>I am trying to write a search, like Requests per second and its percentage based on total count. Please help me out in this. Thank you...</P> Wed, 13 Jan 2016 19:14:06 GMT https://community.splunk.com/t5/Splunk-Search/query-for-percentage-with-count/m-p/225075#M66361 asplunk123 2016-01-13T19:14:06Z https://community.splunk.com/t5/Splunk-Search/query-for-percentage-with-count/m-p/225076#M66362 <P>Try this</P> <PRE><CODE> index=someindex "priceRequest" |rex "some-app/(?&lt;methodName&gt;[a-zA-Z]*)" | rex "processingTime: (?&lt;RTIME&gt;[0-9]*)" | eval RTIME_SEC=(RTIME/1000) | eval group = case(RTIME_SEC &lt; 1, "1 sec", RTIME_SEC &lt; 2,"2 sec", RTIME_SEC &lt; 3,"3 sec", RTIME_SEC &lt; 4,"4 sec",RTIME_SEC &lt; 5,"5 sec",RTIME_SEC &lt; 6,"6 sec",RTIME_SEC&gt;6,"Time Out")| stats count by group,methodName| eventstats sum(count) as total by methodName | eval Perc=round(count*100/total,2) | chart values(count) values(Perc) over group by methodName | appendpipe [| stats sum(*) as * | eval group="Total" | table group *] </CODE></PRE> Wed, 13 Jan 2016 19:23:36 GMT https://community.splunk.com/t5/Splunk-Search/query-for-percentage-with-count/m-p/225076#M66362 somesoni2 2016-01-13T19:23:36Z https://community.splunk.com/t5/Splunk-Search/query-for-percentage-with-count/m-p/225077#M66363 <P>how to add the <STRONG>Total</STRONG> field (row) in bottom of all adding all column values</P> Wed, 13 Jan 2016 20:59:34 GMT https://community.splunk.com/t5/Splunk-Search/query-for-percentage-with-count/m-p/225077#M66363 asplunk123 2016-01-13T20:59:34Z https://community.splunk.com/t5/Splunk-Search/query-for-percentage-with-count/m-p/225078#M66364 <P>You can use addcoltotals command for that. (add to the end)</P> Wed, 13 Jan 2016 21:02:09 GMT https://community.splunk.com/t5/Splunk-Search/query-for-percentage-with-count/m-p/225078#M66364 somesoni2 2016-01-13T21:02:09Z https://community.splunk.com/t5/Splunk-Search/query-for-percentage-with-count/m-p/225079#M66365 <P>@somesoni2, Please help me out here for <STRONG>interchange the location of fields</STRONG></P> Wed, 13 Jan 2016 23:32:14 GMT https://community.splunk.com/t5/Splunk-Search/query-for-percentage-with-count/m-p/225079#M66365 asplunk123 2016-01-13T23:32:14Z https://community.splunk.com/t5/Splunk-Search/query-for-percentage-with-count/m-p/225080#M66366 <P>Not sure if I understand what you need? What is the search that you're trying (before the appendpipe) and what is the fieldnames that you see?</P> Thu, 14 Jan 2016 01:08:30 GMT https://community.splunk.com/t5/Splunk-Search/query-for-percentage-with-count/m-p/225080#M66366 somesoni2 2016-01-14T01:08:30Z https://community.splunk.com/t5/Splunk-Search/query-for-percentage-with-count/m-p/225081#M66367 <P>@somesoni2, yes i mean , interchange the columns.</P> <P>here having 2 requests like priceRequest &amp; priceResponse. actually having query for 1,2 columns are <STRONG>percentages</STRONG> of both requests and 3,4 column are <STRONG>count</STRONG> of both requests respectively. But i am expecting the query as like as <STRONG>Count(priceRequest ) Percentage(priceRequest ) Count(priceResponse) Percentage(priceResponse)</STRONG> respectively...</P> Wed, 20 Jan 2016 23:23:14 GMT https://community.splunk.com/t5/Splunk-Search/query-for-percentage-with-count/m-p/225081#M66367 asplunk123 2016-01-20T23:23:14Z