Hi. I'm brand new to splunk. I've created a table report that shows counts of columns:
Time (Hour)
Result: Good
Result: Bad
Result: Ugly
After the Index and source type, my query has |chart count over _time span=hour by data.result
What do I need to add to query to calculate the Total of Good, Bad, Ugly and then use that to add a column with the percentage of Total Result to the table. Appreciate your help.
This requirement is not clear enough.
Do you want the counts converted to percentages of total per hour or do you want additional columns for each result with percentages of the total per hour or do you want percentages of the grand total or do you want an additional row with the totals for each result or something else?
Please can you provide a mock-up of what you would like to see?