How to display percentage rather than count of a field with multiple values on a timechart?

[bruceclarke]

Hey all,

I've seen some similar questions around this, but none are quite what I want. I have a field with >10 values that I want to display the percentage of total for each value using a timechart. Right now I can easily get the count by doing something like [baseSearch] | timechart count by myField.

The problem that I have is that there's no good way to append the total count to get the percentage. I tried using the appendCols function, but my columns don't appear to be lining up correctly. I'm seeing zero values for total count when the "count by" is non-zero and vice versa.

Does anyone know how I can display the percentage over time rather than the count?

Thanks!

[somesoni2 · Accepted solution]

Try this

your base search  | timechart count by myField | untable _time myField count | eventstats sum(count) as Total by _time | eval perc=round(count*100/Total,2) | table _time myField perc | xyseries _time myfield perc