How do I make a chart overlay that calculates the percentage of a specific row's count vs total, in that time period?

[thisissplunk]

I'm counting up the hits to my website's specific URI's over each day. I'm using chart because I have to bucket by _time for other reasons related to how the data is dumped from a db into splunk:

| bucket span=1d _time
| chart count(uri) as uris by  _time domain

This works fine. But what I'd like to do now is be able to dynamically choose one of the URI's as a chart overlay and show its total percentage of the hits vs the total for the day.

I can't figure out how to do this. Is there a way to access the | addtotals "Total" field but for only one column/URI? Or what about using tokens in the search and rerunning the search as I pick different URI's to overlay? Or....?

I got the idea from this: https://docs.splunk.com/Documentation/SplunkCloud/8.2.2107/SearchTutorial/Chartoverlays but I need to figure out how to calculate the percentages dynamically and against | addtotals "Total"

[ITWhisperer · Accepted solution]

You could do something like this with $token$ holding the URI you want as the overlay (percent)

| addtotals fieldname=_Total
| foreach *
    [| eval percent=if("<<FIELD>>"="$token$",100*'<<FIELD>>'/_Total,percent)]

You could also use the token in the name of the field (series) but you would also need to include it in the overlay configuration

[thisissplunk]

Thank you! I will try this shortly.

Any idea how I do the same idea but just on the domain values instead?