Splunk Search

How to calculate percentage of results returned from a timechart?

Path Finder

I have a timechart for the last 7 days and I want to add a percentage of the two results returned from the timechart data. I know I need an eval to add a total of the two results and then divide the result of the value that I want the percentage by total. I think I would need a table to format the data into a column format.

index=ui_prod sourcetype=instrumentation processCode=NB (val1 OR val2) earliest=-7d latest=-1m | timechart span=1d count as Number_Clicks by dataValue

I want the end result to look like this:

_time         val1    val2    Val2PercentofTotal
2015-07-20    7       3              30%
2015-07-19    160     40             20%
...........
0 Karma

SplunkTrust
SplunkTrust

Try something like this

index=ui_prod sourcetype=instrumentation processCode=NB (val1 OR val2) earliest=-7d latest=-1m | timechart span=1d count as Number_Clicks by dataValue | addtotals fieldname=Val2PercentofTotal val1 val2 | eval Val2PercentofTotal =round((val2*100)/Val2PercentofTotal,2)