Capture the total number of requests before rendering the chart.

[terryloar]

I'm charting some events BY Host which gives me the correct counts for each host. I would like to also display a "% Total Requests" on each line, but can't figure out how to capture the total number of requests before renderng the chart. In other words, I need to be able to do:

Requests / Total Requests for each line in the table.

This is the current search, without the Total Requests:

/nepoc_access.log.1" | lookup dnslookup ip AS client_ip | rename host AS Host | chart count(Host) AS Requests, sum(eval(file_size/1000000000)) AS GBytes by Host | sort 100 -Requests

And the Results are:

Host    Requests    GBytes

1 host1 1382 0.023790
2 host2 1072 0.011972
3 host3 660 0.006896

[gkanapathy]

/nepoc_access.log.1 
| lookup dnslookup ip AS client_ip
| rename host AS Host 
| chart count(Host) AS Requests,  sum(eval(file_size/1000000000)) AS GBytes by Host
| eventstats sum(Requests) as TotalRequests
| eval pctRequests=Requests/TotalRequests
| sort 100 -Requests

[terryloar]

Thanks, gkanapathy. It gave me just what I wanted.