Splunk Search

How to display percentage rather than count of a field with multiple values on a timechart?

bruceclarke
Contributor

Hey all,

I've seen some similar questions around this, but none are quite what I want. I have a field with >10 values that I want to display the percentage of total for each value using a timechart. Right now I can easily get the count by doing something like [baseSearch] | timechart count by myField.

The problem that I have is that there's no good way to append the total count to get the percentage. I tried using the appendCols function, but my columns don't appear to be lining up correctly. I'm seeing zero values for total count when the "count by" is non-zero and vice versa.

Does anyone know how I can display the percentage over time rather than the count?

Thanks!

1 Solution

somesoni2
Revered Legend

Try this

your base search  | timechart count by myField | untable _time myField count | eventstats sum(count) as Total by _time | eval perc=round(count*100/Total,2) | table _time myField perc | xyseries _time myfield perc

View solution in original post

somesoni2
Revered Legend

Try this

your base search  | timechart count by myField | untable _time myField count | eventstats sum(count) as Total by _time | eval perc=round(count*100/Total,2) | table _time myField perc | xyseries _time myfield perc

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!