How to get percentage in stats instead of count?

[zacksoft]

I am calculating number of web-calls that were served in certain seconds.
| stats count(web-calls) as web-call-count by server_response.

So, in x axis I see the seconds, and Y axis i see the number of web-calls ..in a column chart.
What we are looking for is, "Can we get the percentage of web-calls instead of count in Y-axis" ?

[kamlesh_vaghela · Accepted solution]

@zacksoft

Can you please try this?

YOUR_SEARCH | stats count(web-calls) as web-call-count by server_response | eventstats sum(web-call-count) as total | eval percentage=round((web-call-count*100/total),2) | table server_response percentage

[zacksoft]

The command works perfectly. Thank you...
If I may add one more thing, Is it possible to create buckets ..say something like 3 buckets.
Bucket 1 showing the percentage of web-calls whose response were less than a second.
Bucket 2 showing percentage of web-calls ...between 1 to 10 sec.
Bucket 3 showing ..more tan 10 sec..

May be in a column chart showing three columns as three buckets or any other way..we can visualize ???

[kamlesh_vaghela]

@zacksoft
Yes, we can eval one more filed Bucket. For this sample data and expected output will be appreciated. 🙂

[zacksoft]

I have put some sample data here along with more description
https://answers.splunk.com/answers/742026/creating-buckets-based-a-percentage-of-occurrence.html?min...