Hi,
I'm using a column visualization and the stack mode "100%". It would be nice to have the percentages in the chart instead of total values. Is this possible without calculating the percentages in the search?
BR
Heinz
Calculating that in search isn't hard though:
index=_internal | timechart count by sourcetype | addtotals fieldname=_Total | foreach * [eval <<FIELD>> = '<<FIELD>>' * 100 / _Total] | fields - _Total
You can move the addtotals | foreach | fields
into a macro and reuse it.
Calculating that in search isn't hard though:
index=_internal | timechart count by sourcetype | addtotals fieldname=_Total | foreach * [eval <<FIELD>> = '<<FIELD>>' * 100 / _Total] | fields - _Total
You can move the addtotals | foreach | fields
into a macro and reuse it.
Awesome, didn't know it can be done so easy. Thanks!
I don't think so.