I'm counting up the hits to my website's specific URI's over each day. I'm using chart because I have to bucket by _time for other reasons related to how the data is dumped from a db into splunk:
| bucket span=1d _time
| chart count(uri) as uris by _time domain
This works fine. But what I'd like to do now is be able to dynamically choose one of the URI's as a chart overlay and show its total percentage of the hits vs the total for the day.
I can't figure out how to do this. Is there a way to access the | addtotals "Total" field but for only one column/URI? Or what about using tokens in the search and rerunning the search as I pick different URI's to overlay? Or....?
I got the idea from this: https://docs.splunk.com/Documentation/SplunkCloud/8.2.2107/SearchTutorial/Chartoverlays but I need to figure out how to calculate the percentages dynamically and against | addtotals "Total"
You could do something like this with $token$ holding the URI you want as the overlay (percent)
| addtotals fieldname=_Total
| foreach *
[| eval percent=if("<<FIELD>>"="$token$",100*'<<FIELD>>'/_Total,percent)]
You could also use the token in the name of the field (series) but you would also need to include it in the overlay configuration
You could do something like this with $token$ holding the URI you want as the overlay (percent)
| addtotals fieldname=_Total
| foreach *
[| eval percent=if("<<FIELD>>"="$token$",100*'<<FIELD>>'/_Total,percent)]
You could also use the token in the name of the field (series) but you would also need to include it in the overlay configuration
Thank you! I will try this shortly.
Any idea how I do the same idea but just on the domain values instead?