I'm counting up the hits to my website's specific URI's over each day. I'm using chart because I have to bucket by _time for other reasons related to how the data is dumped from a db into splunk:
| bucket span=1d _time
| chart count(uri) as uris by _time domain
This works fine. But what I'd like to do now is be able to dynamically choose one of the URI's as a chart overlay and show its total percentage of the hits vs the total for the day.
I can't figure out how to do this. Is there a way to access the | addtotals "Total" field but for only one column/URI? Or what about using tokens in the search and rerunning the search as I pick different URI's to overlay? Or....?