How to view percentages in column chart instead of total values without calculating percentages in search?

[HeinzWaescher]

Hi,

I'm using a column visualization and the stack mode "100%". It would be nice to have the percentages in the chart instead of total values. Is this possible without calculating the percentages in the search?

BR

Heinz

[martin_mueller · Accepted solution]

Calculating that in search isn't hard though:

index=_internal | timechart count by sourcetype | addtotals fieldname=_Total | foreach * [eval <<FIELD>> = '<<FIELD>>' * 100 / _Total] | fields - _Total

You can move the addtotals | foreach | fields into a macro and reuse it.

[HeinzWaescher]

Awesome, didn't know it can be done so easy. Thanks!

[martin_mueller]

I don't think so.