How to use addcoltotals to calculate percentage?

[LearningGuy]

How to use addcoltotals to calculate percentage?
For example:  my search below   scoreSum % is empty 
Thank you for your help

index=test
| stats sum(score) as scoreSum by vuln
| addcoltotals labelfield =vuln   label=Total_scoreSum scoreSum
| eval scoreSum_pct = scoreSum/Total_scoreSum*100 . "%"
| table vuln, scoreSum, scoreSum_pct

Result:

vuln	scoreSum	scoreSum %
vulnA	20
vulnB	40
vulnC	80
Total_scoreSum	140

Expected result

vuln	scoreSum	scoreSum_pct
vulnA	20	14.3%
vulnB	40	28.6%
vulnC	80	57.1%
Total_scoreSum	140	100%

[ITWhisperer · Accepted solution]

Try something like this

index=test
| stats sum(score) as scoreSum by vuln
| eventstats sum(scoreSum) as total
| eval scoreSum_pct=100*scoreSum/total
| fields - total
| addcoltotals labelfield =vuln   label=Total_scoreSum scoreSum scoreSum_pct
| eval scoreSum_pct = round(scoreSum_pct,1) . "%"
| table vuln, scoreSum, scoreSum_pct

[LearningGuy]

Hello,
I tried your suggestion and it worked successfully. I accepted this as solution. I appreciate your help. Thank you.

1)    If I printed out "total" field, it can give total 140 in each row.   
How did eventstats know how to calculate the total of 140, when "stats" command has scoreSum of 20/40/80?         
If I played around and used "stats" or "eventstats group by vuln", it didn't work.  Please suggest

         | eventstats sum(scoreSum) as total    

vuln	scoreSum	total	scoreSum_pct
vulnA	20	140	14.3%
vulnB	40	140	28.6%
vulnC	80	140	57.1%
Total_scoreSum	140	420	100%

2)   If there are hundreds of row, there will be multi pages. The "Total_scoreSum" field will appear at the end of the row.
       Is there a way to display it on the first page, but at the bottom, not at the top (using sort)?
| addcoltotals labelfield =vuln label=Total_scoreSum scoreSum scoreSum_pct

Thank you so much

[ITWhisperer]

1) eventstats adds the aggregated value (sum in this instance) to each event, stats replaces the events with the aggregated statisitcs

2) No, this is not normally possible - addtotals adds an extra event (row) to the pipeline at the end. The way the pipeline is displayed happens after the total row has been added and there is no way to predict how big the first page of the display is going to be ahead of time.