I think I have the result you're looking for. It's a bit of an ugly query, so I'll walk through it here.
First off, I took the liberty of cleaning up your initial query; I eliminated a few unnecessary parts and renamed some variables which I thought were unclear (such as all the "total"s). At the end of this first step, I had this:
<your search> | bucket _time span=1h | eventstats count as rowTotal by _time | eventstats count AS "statusTotal" by _time, status | eval percent=(statusTotal/rowTotal)*100 | timechart span=1h first(percent) by status
Now, in order to find the new "total" column you're looking for, we have to calculate the total for each row (which we have, as the field "rowTotal") and divide it by the overall number of events (which is easy to find), then multiply by 100. Unfortunately, we need to use "appendcols" and repeat our previous seach in order to actually get this percentage onto our resulting timechart, which does reduce performance. On the other hand, if we simply tried to throw a "values(totalPercent)" statement into our existing timechart, it would list the overall percentage for EACH status...which makes our results table look messy and redundant.
As such, I used appendcols since I believe proper formatting is your goal here. The section to append this overall percentage looks like this:
... | appendcols[ <your search> | eventstats count as overallTotal | bucket _time span=1h | eventstats count as rowTotal by _time | eval totalPercent=(rowTotal/overallTotal)*100 | timechart span=1h values(totalPercent)]
With all that done, our overall query with the two sections combined looks like this:
<your search>| bucket _time span=1h | eventstats count as rowTotal by _time | eventstats count AS "statusTotal" by _time, status | eval percent=(statusTotal/rowTotal)*100 | timechart span=1h first(percent) by status | appendcols[<your search> | eventstats count as overallTotal | bucket _time span=1h | eventstats count as rowTotal by _time | eval totalPercent=(rowTotal/overallTotal)*100 | timechart span=1h values(totalPercent)]
It is not pretty by any means, but it does get the results which I think you want. And sorry for the long explanation.
... View more