https://community.splunk.com/t5/Splunk-Search/Timechart-with-multiple-fields-and-calculating-percentage/m-p/40922#M9477 <P>My query is something like</P> <P>.. | eval color_and_shape = color + "/" + shape<BR /> | timechart count as total, count(eval(heavy="true")) as heavy by color_and_shape</P> <P>which returns a table similar to</P> <P>_time heavy:green/triangle heavy:green/circle total:green/triangle total:green/circle</P> <P>11/20/12 1 2 5 6</P> <P>How would I go about calculating the percentage of shapes that a heavy by color_and_shape?</P> <P>I tried doing ...| eval pct=sc/total <BR /> but this does not work.</P> Mon, 28 Sep 2020 12:50:32 GMT benobviate 2020-09-28T12:50:32Z https://community.splunk.com/t5/Splunk-Search/Timechart-with-multiple-fields-and-calculating-percentage/m-p/40922#M9477 <P>My query is something like</P> <P>.. | eval color_and_shape = color + "/" + shape<BR /> | timechart count as total, count(eval(heavy="true")) as heavy by color_and_shape</P> <P>which returns a table similar to</P> <P>_time heavy:green/triangle heavy:green/circle total:green/triangle total:green/circle</P> <P>11/20/12 1 2 5 6</P> <P>How would I go about calculating the percentage of shapes that a heavy by color_and_shape?</P> <P>I tried doing ...| eval pct=sc/total <BR /> but this does not work.</P> Mon, 28 Sep 2020 12:50:32 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-with-multiple-fields-and-calculating-percentage/m-p/40922#M9477 benobviate 2020-09-28T12:50:32Z https://community.splunk.com/t5/Splunk-Search/Timechart-with-multiple-fields-and-calculating-percentage/m-p/40923#M9478 <P>The problem is that after you've run the results through timechart, you no longer know all the combinations of column headers you'll need to calculate the percentage.</P> <P>A better way of approaching this would be to work out the percentages before running timechart like this :</P> <PRE><CODE>... | eval color_and_shape = color + "/" + shape | bin _time span=1d | stats count as total, count(eval(heavy="true")) as heavy by color_and_shape _time | eval perc_heavy=100*heavy/total </CODE></PRE> <P>Then you can do the timechart</P> <PRE><CODE>... | timechart span=1d first(total) as total first(heavy) as heavy first(perc_heavy) as perc_heavy by color_and_shape </CODE></PRE> Wed, 21 Nov 2012 00:26:45 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-with-multiple-fields-and-calculating-percentage/m-p/40923#M9478 jonuwz 2012-11-21T00:26:45Z