I've been looking at some similar questions .. (for instance, this showed how to have timechart display % each day instead of totals: https://answers.splunk.com/answers/180723/how-to-display-percentage-rather-than-count-of-a-f.html) (sorry if this doesn't show - i am new to the answers forum and it says I don't have enough karma yet to post links)
What we really want is for the timechart to show counts (the default), but to alter the legend if possible, so instead of the legend just mimicking the total for each day when you mouse-over a data point, the legend by default would show % of total data next to each item. (Ideally also it would be nice to have the legend sort so that the highest-percentage item would bubble to the top, etc., though from other posts it sounds like it is very difficult to deviate from alphabetic listing of items?).
for example, if my basic chart search starts with something like: index=hec earliest=-7d| timechart count by category
and it shows 5 category examples, and say the category named "Session" is most common at 60% (covering the 7d span), at minimum we would like to display something like "60.0%" next to "Session" in the legend, and even better if we can have "Session" be first item listed in the legend because it has the highest %.
If this is not practical within a single "chart" or report, perhaps we can turn off the legend and set up a dashboard with 2 searches of the same data next to each to simulate the same outcome?
I appreciate any advice on this. Thanks!
