Timechart usind the percentage field

[duygu]

Hi,

I am trying to build a timechart but only using the "percent" field according to the example search below. Can anyone please help me?

Thanks

index=* source=*
| stats values(bytes) as bytes values(clientip) as clientip values(Time) as Time
| chart count OVER bytes
| eventstats sum(count) As total
| eval percent=round((100*count/total),2)

[renjith_nair]

Hi @duygu,

Are you looking for something like this?

index="your index" source="your source"|timechart span=10m count(bytes)  by clientip 
|addtotals row=true fieldname=_Total|foreach * [eval <<FIELD>> = round(('<<FIELD>>' * 100 / _Total),2)]

change the span and also the aggregation function count according to your requirement

[renjith_nair]

Hi @duygu, lets know if you still have questions

[FrankVl]

Your example search doesn't make a lot of sense to me.

| stats values(bytes) as bytes values(clientip) as clientip values(Time) as Time
No by-clause, so this will result in a single row result (potentially with multi valued fields)

| chart count OVER bytes
This will result in a single count = 1, given that the previous part of the query was a single row result.

| eventstats sum(count) As total
This will therefore also result in 1.

| eval percent=round((100*count/total),2)
This would make sense if the count and total made sense.

Can you please explain what percentage you want to calculate (and timechart)?