using addcoltotals

[dolj]

Can you leverage the total derived using the addcoltotals command to support other calculations? i.e. can you use it to calculate a percentage? 

| addcoltotals count labelfield="total"
| eval percent=((count/total)*100)
| table host count percent

[bowesmana]

You can't use the total calculated by addcoltotals as it's in a new row at the bottom of the table, however, as @richgalloway the typical way to calculate percentages is to use eventstats to add up all the counts, so that the total is added to _every_ row in your data set, which you can then calculate the percentages with.

Then discard that calculated total field if you no longer need it

[richgalloway]

Yes, the output of the addcoltotals command can be used to perform calculations.  The sample code, however, won't work.  That's because the value of the "total" field created by addcoltotals is text (the label) rather than a number so the eval will fail.

Another way to get percentages is to use eventstats to compute the total then eval the percentage.

| eventstats sum(count) as total
| eval percent=((count/total)*100)
| table host count percent