https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-calculate-a-percentage-for-my-timechart/m-p/235347#M69892 <P>ok thanks.. I'm not getting results.. <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> Tue, 22 Nov 2016 17:38:19 GMT k_harini 2016-11-22T17:38:19Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-calculate-a-percentage-for-my-timechart/m-p/235341#M69886 <P>I have to calculate % of SLA missed over time.</P> <PRE><CODE>basesearch|dedup ID|EVAL sla_status = case(Status like "Closed MPT Warning%","Closed-MPT Warning",Status like "Closed MPT Exceeded%","Closed-MPT Exceeded",Status like "Closed IRT Exceeded%","Closed-IRT Exceeded",Status like "Closed IRT Warning%","Closed-IRT Warning",Status like "Closed%","Closed") |timechart count as sla_count by sla_status |addtotals| foreach * [eval sla_perc = count * 100 /Total] </CODE></PRE> <P>Not sure why this is not working. Please help</P> Tue, 22 Nov 2016 14:03:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-calculate-a-percentage-for-my-timechart/m-p/235341#M69886 k_harini 2016-11-22T14:03:42Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-calculate-a-percentage-for-my-timechart/m-p/235342#M69887 <P>1.) what is the result you get?<BR /> 2.) in your foreach [eval sla_perc = <STRONG>count</STRONG> 100 /Total] statement... shouldnt the <STRONG>count</STRONG> be a <STRONG>sla_count</STRONG>?<BR /> Asking because in the timechart you define count as sla_count "|timechart <STRONG>count as sla_count</STRONG> by sla_status "</P> Tue, 29 Sep 2020 11:51:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-calculate-a-percentage-for-my-timechart/m-p/235342#M69887 PPape 2020-09-29T11:51:38Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-calculate-a-percentage-for-my-timechart/m-p/235343#M69888 <P>Try this</P> <PRE><CODE>basesearch|dedup ID|EVAL sla_status = case(Status like "Closed MPT Warning%","Closed-MPT Warning",Status like "Closed MPT Exceeded%","Closed-MPT Exceeded",Status like "Closed IRT Exceeded%","Closed-IRT Exceeded",Status like "Closed IRT Warning%","Closed-IRT Warning",Status like "Closed%","Closed") |timechart count as sla_count by sla_status | addtotals| foreach * [eval &lt;&lt;FIELD&gt;&gt;=if(&lt;&lt;FIELD&gt;&gt;==Total, &lt;&lt;FIELD&gt;&gt;, &lt;&lt;FIELD&gt;&gt;/Total)] </CODE></PRE> Tue, 22 Nov 2016 14:50:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-calculate-a-percentage-for-my-timechart/m-p/235343#M69888 sundareshr 2016-11-22T14:50:27Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-calculate-a-percentage-for-my-timechart/m-p/235344#M69889 <P>I get results till Total.. Not getting %.. yes.. it was sla_count.. First did with count and then tried with alias too.. Not working</P> Tue, 22 Nov 2016 17:24:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-calculate-a-percentage-for-my-timechart/m-p/235344#M69889 k_harini 2016-11-22T17:24:39Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-calculate-a-percentage-for-my-timechart/m-p/235345#M69890 <P>which field should i compare with Total.. I just need %.. (count/total)*100 for all values...</P> Tue, 22 Nov 2016 17:25:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-calculate-a-percentage-for-my-timechart/m-p/235345#M69890 k_harini 2016-11-22T17:25:54Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-calculate-a-percentage-for-my-timechart/m-p/235346#M69891 <P><CODE>&lt;&lt;FIELD&gt;&gt;</CODE> represents each field in the "table". In this case, it will exclude fieldName=Total. Are you not seeing correct results?</P> Tue, 22 Nov 2016 17:31:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-calculate-a-percentage-for-my-timechart/m-p/235346#M69891 sundareshr 2016-11-22T17:31:03Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-calculate-a-percentage-for-my-timechart/m-p/235347#M69892 <P>ok thanks.. I'm not getting results.. <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> Tue, 22 Nov 2016 17:38:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-calculate-a-percentage-for-my-timechart/m-p/235347#M69892 k_harini 2016-11-22T17:38:19Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-calculate-a-percentage-for-my-timechart/m-p/235348#M69893 <P>If the field names are numerical, enclose <CODE>&lt;&lt;FIELD&gt;&gt;</CODE> within single quotes - <CODE>'&lt;&lt;FIELD&gt;&gt;'</CODE></P> Tue, 22 Nov 2016 18:18:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-calculate-a-percentage-for-my-timechart/m-p/235348#M69893 sundareshr 2016-11-22T18:18:10Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-calculate-a-percentage-for-my-timechart/m-p/235349#M69894 <P>Thank you so much.. it worked.. <CODE>foreach * [eval &lt;&gt;=round('&lt;&gt;'*100/Total]</CODE>.. I was struggling with this for such a long time..</P> Tue, 22 Nov 2016 18:56:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-calculate-a-percentage-for-my-timechart/m-p/235349#M69894 k_harini 2016-11-22T18:56:10Z