How to show count & percentage of the total count in a chart command?

[djoobbani]

Dear splunk community:

So i am using the following chart command:

<base search> | chart count by url_path, http_status_code |  addtotals col=true

to get the following search result: URL (Y-Axis) & http status code (X-Axis)

                        200     400     500     502     Total

url1                    15        5          5         5         30

url2                    10       3          6          2         21

                          25       8          11         7         51

Now i need to add the percentage of each count based on the total number and display the count & percentage together like so:

                        200                    400                   500               502              Total

url1               15 (50%)           5 (16%)         5 (16%)        5(16%)         30

url2                10 (47%)          3 (14%)         6 (28%)         2 (9%)          21

                          25 (49%)        8 (15%)         11 (21%)      7 (13%)        51

Can someone show me how to achieve this? Greatly appreciate your help in advance!

[djoobbani]

Thank you very much for the explanation bowesmana.

So i took your SPL (above) and tried running it in my environment, but unfortunately the result is blank and that may be related to the comment u made regarding count turning into a non numeric value. So does this mean there is no solution for this in splunk? Again thanks for your reply!

[bowesmana]

Blank results might mean you have no permission to view _internal index...

However,  I am not aware of any way to append some text to a number and for Splunk to then plot that numerically. One thought it that if you add data values ON to the chart, whether with some Javascript and CSS you could dynamically change the visible text to add the percentage, but I don't know how to do that.

See this developer tools view of the <tspan> element showing the data label of the graph value. I suspect this IS possible, but you would need to have the CSS and probably Javascript knowledge to do it.

[bowesmana]

As I suggested in my post to the same question you asked in your other post https://community.splunk.com/t5/Splunk-Search/How-to-get-the-chart-of-count-and-percentage-by-in-one...

you can combine the percentage using the SPL I posted there, which gives you exactly the table you display here, see this.

However, as soon as you turn a count into a non numeric value, it is no longer a numeric value, so Splunk will not chart that as a vertical Y-axis value.