topic Re: display lookup file data even if count is zero in Splunk Search

display lookup file data even if count is zero

marellasunil — Mon, 28 Sep 2020 13:29:58 GMT

I have uploaded CSV file contains service names, the query which ever I am runing is not displaying the services names, if count is zero.
Ex : csv file contain row name Service_name and values service1, service2, service3, service4 ... service 50
I have added the row name in extract fields as service_name,
If I use the command ".. | chart count by service_name", it is not displying the values equal to 0 however I am getting the results for other services which ever is not zero.

Re: display lookup file data even if count is zero

martin_mueller — Tue, 12 Mar 2013 16:11:40 GMT

Before your chart command, append the lookup file like this:

... | append [inputlookup <your lookup here>] | chart ...

Then reduce the count by one for each service name to account for the extra events appended.

Re: display lookup file data even if count is zero

marellasunil — Wed, 13 Mar 2013 13:01:40 GMT

Hi,

Small modification, I have to do. I have to calculate status as well.
... | append [inputlookup service.csv] | chart count over service_name by status
I am getting a coulmn NULL if I run the query and alsi in XML also counting as NULL.
Can you please suggest what can I do for this.

Re: display lookup file data even if count is zero

marellasunil — Thu, 14 Mar 2013 11:40:07 GMT

Used field - NULL..
XML used inputlookup ..
worked there too...
It worked fine. Thanks Martin....
:-)