https://community.splunk.com/t5/Getting-Data-In/How-would-I-display-all-hosts-with-AND-without-events/m-p/136839#M28182 <P>I think I could definitely make something work with that.</P> <P>Will try outputting "host=* | stats count by host" to a lookup file then using your above answer to see if yields the desired results. Thanks!</P> <P><EM>Edit</EM><BR /> TESTED AND WORKS GREAT! THANK YOU!</P> Fri, 24 Jul 2015 17:37:51 GMT tylergps 2015-07-24T17:37:51Z https://community.splunk.com/t5/Getting-Data-In/How-would-I-display-all-hosts-with-AND-without-events/m-p/136834#M28177 <P>I'm trying to audit an environment based on Window's RDP event codes 21, 22, and 25. I'm able to display the number of RDP events for systems that have them, but for the ones that don't, I can't get them to display a value of 0 in the results.</P> <P>I tried using "fillnull" but couldn't find a solution.</P> <P>Search:</P> <PRE><CODE>source="wineventlog:microsoft-windows-terminalservices-localsessionmanager/operational" (EventCode=21 OR EventCode=22 OR EventCode=25) | stats count by host </CODE></PRE> Thu, 23 Jul 2015 22:44:58 GMT https://community.splunk.com/t5/Getting-Data-In/How-would-I-display-all-hosts-with-AND-without-events/m-p/136834#M28177 tylergps 2015-07-23T22:44:58Z https://community.splunk.com/t5/Getting-Data-In/How-would-I-display-all-hosts-with-AND-without-events/m-p/136835#M28178 <P>Assuming you have a list of expected hosts in a lookup file with a single column <CODE>host</CODE>, you can do something like this:</P> <PRE><CODE>... | stats count by host | append [inputlookup expected_hosts | eval count = 0] | stats max(count) as max by host </CODE></PRE> Fri, 24 Jul 2015 00:03:43 GMT https://community.splunk.com/t5/Getting-Data-In/How-would-I-display-all-hosts-with-AND-without-events/m-p/136835#M28178 martin_mueller 2015-07-24T00:03:43Z https://community.splunk.com/t5/Getting-Data-In/How-would-I-display-all-hosts-with-AND-without-events/m-p/136836#M28179 <P>I wish you would be able to do a sub search or something.</P> <P>Wanted to try to avoid adding complexity with the lookup file. It may be my only solution though...</P> Fri, 24 Jul 2015 01:06:03 GMT https://community.splunk.com/t5/Getting-Data-In/How-would-I-display-all-hosts-with-AND-without-events/m-p/136836#M28179 tylergps 2015-07-24T01:06:03Z https://community.splunk.com/t5/Getting-Data-In/How-would-I-display-all-hosts-with-AND-without-events/m-p/136837#M28180 <P>If you want to have all the hosts listed, even those without any events, then this is the way to go to make sure you get all hosts. </P> Fri, 24 Jul 2015 01:36:41 GMT https://community.splunk.com/t5/Getting-Data-In/How-would-I-display-all-hosts-with-AND-without-events/m-p/136837#M28180 MuS 2015-07-24T01:36:41Z https://community.splunk.com/t5/Getting-Data-In/How-would-I-display-all-hosts-with-AND-without-events/m-p/136838#M28181 <P>You could of course use Splunk to build this lookup, adding hosts but never removing them: <A href="http://blogs.splunk.com/2011/01/11/maintaining-state-of-the-union/">http://blogs.splunk.com/2011/01/11/maintaining-state-of-the-union/</A></P> Fri, 24 Jul 2015 13:40:52 GMT https://community.splunk.com/t5/Getting-Data-In/How-would-I-display-all-hosts-with-AND-without-events/m-p/136838#M28181 martin_mueller 2015-07-24T13:40:52Z https://community.splunk.com/t5/Getting-Data-In/How-would-I-display-all-hosts-with-AND-without-events/m-p/136839#M28182 <P>I think I could definitely make something work with that.</P> <P>Will try outputting "host=* | stats count by host" to a lookup file then using your above answer to see if yields the desired results. Thanks!</P> <P><EM>Edit</EM><BR /> TESTED AND WORKS GREAT! THANK YOU!</P> Fri, 24 Jul 2015 17:37:51 GMT https://community.splunk.com/t5/Getting-Data-In/How-would-I-display-all-hosts-with-AND-without-events/m-p/136839#M28182 tylergps 2015-07-24T17:37:51Z