topic Re: values are missing post lookup in Splunk Search

values are missing pot lookup

abdul — Mon, 26 Apr 2021 09:46:38 GMT

Not able to find the stats details for all M. tried fill null . it is not working

index=UA sourcetype=apps appname="xyz*"
|fields EID
|dedup EID
|lookup employee.csv EID as EID
|search MID in (M1,M2,M3 M4,M5,M6)
|stats count(EID) as total by MID

getting below result. but missing results for M4, M5, M6

MID total
M1 2
M2 3
m3 4

Expecting below results

MID total
M1 2
M2 3
M3 4
M4 0
M5 0
M6 0

Re: values are missing pot lookup

gcusello — Mon, 26 Apr 2021 09:58:28 GMT

Hi @abdul,

the lookup command associates the lookup values only to the key values that are in the search results, so, if you haven't results, you cannot associate any lookup value.

You can reach your target with a different approach:

In this way you add to your search the condition for the MID not present in the search results.

Ciao.

Giuseppe

Re: values are missing pot lookup

abdul — Wed, 28 Apr 2021 15:36:56 GMT

Hi @gcusello ,

now below result is appearing
MID total
M1 0
M2 0
m3 0

Re: values are missing post lookup

abdul — Wed, 28 Apr 2021 16:11:52 GMT