You can use the foreach command to calculate the percentage for each column iteratively. In my example, I'm creating a timechart counting different values of my variable view_version , and formatting the results as a percentage in a 100 Percent Stacked column chart. base_search | timechart count by view_version | addtotals fieldname=_Total | foreach * [eval <<FIELD>> = '<<FIELD>>' * 100 / _Total] | fields - _Total The fields command removes the _Total field from the final table. Source: http://answers.splunk.com/answers/169174/percentage-charting-over-time-percentage-of-fieldc.html#answer-169251 ... View more