base search| mvexpand Name | stats dc(Name) as totalcve by severity | appendcols [|inputlookup lookupname| stats count(Name) as TotalCVE] |eval perc=tostring(totalcve/TotalCVE*100, "commas")."%
I have a search that outputs below table
Severity totalCVE TotalCVE perc
High 2000 10000 20%
Medium 1000
Low 500
How can I append a single value (TotalCVE) to multiple rows and get perc for medium and low severities?
Give this a try
base search| mvexpand Name | stats dc(Name) as totalcve by severity | eval TotalCVE=[|inputlookup lookupname| stats count(Name) as search ] |eval perc=tostring(totalcve/TotalCVE*100, "commas")."%
Try ... | filldown TotalCVE | eval perc=...
.