How to get a line percentage of 200 responses?

[grotti]

I have this current search:

index=web
| eval Year=strftime(_time,"%Y")
| eval Month=date_month
| eval success=if(status=200,1=1,0)
| search status=200 OR status=403
| chart count by Month, status
| eval orden = if(Month="january",1,if(Month="february",2,if(Month="march",3,if(Month="april",4,if(Month="may",5,if(Month="june",6,if(Month="july",7,if(Month="august",8,if(Month="september",9,if(Month="october",10,if(Month="november",11,12)))))))))))
| sort orden
| fields - orden

This search shows a graph of the amount of status "200" and "403" separated by months, I'm trying to develop a percentage line of the amount of status 200 compared to the total, how do I do this? can you help me please!

[bowesmana · Accepted solution]

Add this line after your chart line

| addtotals
| eval Percent=round('200'/Total*100,2)
| fields - Total

then in your bar chart, select the Format/Chart Overlay and add the Percent as a chart overlay and turn on the extra axis and it will give you a line showing the percentage of 200s against the total of 200s + 403s.

If you want the total of all events including other status values, you will need to do it a bit differently.

I know you're not using 'success' value, but your 

| eval success=if(status=200,1=1,0)

should set the success = 1 not 1=1 and that won't be useful

Also, if you just want 200s and 403s then it's more efficient to put that search constraint in the first search line.,