How to edit my search to calculate percentage across columns for multiple fields?

[cburgman]

Looking for some assistance with trying to fix my search to calculate percentage on several columns.

Here is what I am trying to see:

Count      3sec    3to10sec    10to30sec
X          X       X           X 
Percent    X%      X%          X%

Here is my search so far:

sourcetype="mcafee:wg:kv"  
 | rangemap field=time_total "0-3sec"=0-3000, "3-10sec"=3001-10000, "10-30sec"=10001-30000, "30sec-1min"=30001-60000, "1min-5min"=60001-300000, "5min-10min"=300001-600000, default=">10min"  
 | stats count as Count count(eval(range="0-3sec")) as 3sec count(eval(range="3-10sec")) as 3to10sec count(eval(range="10-30sec")) as 10to30sec count(eval(range="30sec-1min")) as 30secto1min count(eval(range="1min-5min")) as 1minto5min count(eval(range="5min-10min")) as 5minto10min count(eval(range=">10min")) as grt10min

[woodcock]

Like this:

sourcetype="mcafee:wg:kv"  
| eval time_total_buckets=case(time_total<=3000, "0-3sec",
                               time_total<=10000, "3-10sec",
                               time_total<=30000, "10-30sec",
                               time_total<=60000, "30sec-1min",
                               time_total<=300000, "1min-5min",
                               time_total<=600000, "5min-10min",
                               true(), ">10min")
| top limit=0 time_total_buckets
| addtotals row=f col=t 
| fillnull value="TOTAL" 
| multireport 
     [ fields - percent | eval RowType="count" ] 
     [ fields - count | rename percent AS count | eval RowType="percent"]
| xyseries RowType time_total_buckets count

[cburgman]

works great... thanks!

[woodcock]

Be sure to click Accept to close the question.