Splunk Search

How to Add Total along with Percentage in result?

smrutiphadke
Engager

I am calculating percentage for each https status code. But i also would like to display the total number of requests in results. Below query displays only percentage of each status code. Is there a way i can add _Total in results?

Query:

index=app_ops_prod host="sl55caehepc20*" OR host="sl55sdsapp001" OR host="sl55sdsapp002" source="/var/mware/logs/SDS*/*localhost*" method="POST" | timechart span=1d count by status|addtotals row=true fieldname=_Total|foreach * [eval <<FIELD>> = '<<FIELD>>' * 100 / _Total] 
Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

_Total is in the results, it is just hidden because it begins with an underscore. Try adding the following line

| rename _Total as Total

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

_Total is in the results, it is just hidden because it begins with an underscore. Try adding the following line

| rename _Total as Total
0 Karma

smrutiphadke
Engager

Worked like a charm! Thanks @ITWhisperer  🙂

0 Karma
Get Updates on the Splunk Community!

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...