When calculating a percentage of status codes with the timechart command, how come the result doesn't sum to 100%?

[Mohsin123]

Hi ,

i am trying to calculate a percentage of status codes over time, but the calculation doesn't sum up to 100% .
Can anyone suggest what i am doing wrong here?

index=idxix_iod sourcetype IN ("prod") status IN(200,201,204,302,400,401,403,404,429,500) 
| chart useother=f span=1h count over _time by status 
| addtotals| timechart span=1h values(eval(200*100/Total)) AS 200 ,
    values(eval(201*100/Total)) AS 201, values(eval(204*100/Total)) AS 204,values(eval(302*100/Total)) AS 302,values(eval(400*100/Total)) AS 400,values(eval(401*100/Total)) AS 401,values(eval(403*100/Total)) AS 403,values(eval(404*100/Total)) AS 404,values(eval(429*100/Total)) AS 429,values(eval(500*100/Total)) AS 500

[maciep · Accepted solution]

I think splunk maybe just doing the math exactly as you have typed in the timerchart. Trying wrapping those fields in single quotes.

...| timechart span=1h values(eval('200'*100/Total)) AS 200 ,values(eval('201'*100/Total)) AS 201  .....

[Mohsin123]

thankyou so much