https://community.splunk.com/t5/Splunk-Search/inputlookup-csv-with-Distinct-count/m-p/468008#M131772 <P>Thanks for your reply, but the above query is not taking the inputs from the file</P> Wed, 08 Apr 2020 22:21:13 GMT priya777 2020-04-08T22:21:13Z https://community.splunk.com/t5/Splunk-Search/inputlookup-csv-with-Distinct-count/m-p/468005#M131769 <P>Hi There!<BR /> I have created a list of 2000 names in a CSV file. I am trying to get the phone numbers of these 2000 people using the below query,</P> <PRE><CODE>index=*** event=contact [ | inputlookup names.csv | fields names ] | stats dc(phoneNumber) by names | fillnull value=0 names </CODE></PRE> <P>When I do the distinct count I only get the names who are registered, but I need the remaining names - dc(phone_numbers) as 0, when I run the query. </P> Tue, 07 Apr 2020 19:56:16 GMT https://community.splunk.com/t5/Splunk-Search/inputlookup-csv-with-Distinct-count/m-p/468005#M131769 priya777 2020-04-07T19:56:16Z https://community.splunk.com/t5/Splunk-Search/inputlookup-csv-with-Distinct-count/m-p/468006#M131770 <P>@DalJeanis Please suggest</P> Tue, 07 Apr 2020 20:02:04 GMT https://community.splunk.com/t5/Splunk-Search/inputlookup-csv-with-Distinct-count/m-p/468006#M131770 priya777 2020-04-07T20:02:04Z https://community.splunk.com/t5/Splunk-Search/inputlookup-csv-with-Distinct-count/m-p/468007#M131771 <P>Your query filters <CODE>index=*** event=contact</CODE> with <CODE>names</CODE> exist in lookup file. Use <CODE>OR</CODE> in the search like below.</P> <PRE><CODE>index=*** event=contact OR [ | inputlookup names.csv | fields names ] | stats dc(phoneNumber) by names | fillnull value=0 names </CODE></PRE> Wed, 08 Apr 2020 05:11:07 GMT https://community.splunk.com/t5/Splunk-Search/inputlookup-csv-with-Distinct-count/m-p/468007#M131771 manjunathmeti 2020-04-08T05:11:07Z https://community.splunk.com/t5/Splunk-Search/inputlookup-csv-with-Distinct-count/m-p/468008#M131772 <P>Thanks for your reply, but the above query is not taking the inputs from the file</P> Wed, 08 Apr 2020 22:21:13 GMT https://community.splunk.com/t5/Splunk-Search/inputlookup-csv-with-Distinct-count/m-p/468008#M131772 priya777 2020-04-08T22:21:13Z https://community.splunk.com/t5/Splunk-Search/inputlookup-csv-with-Distinct-count/m-p/468009#M131773 <PRE><CODE> index=yours event=contact | inputlookup append=t names.csv | stats dc(phoneNumber) by names </CODE></PRE> <P>names.csv:</P> <PRE><CODE>names johndoo hoobar </CODE></PRE> <P>How about this. If your csv is not this format, fix it.</P> Wed, 08 Apr 2020 22:43:04 GMT https://community.splunk.com/t5/Splunk-Search/inputlookup-csv-with-Distinct-count/m-p/468009#M131773 to4kawa 2020-04-08T22:43:04Z