https://community.splunk.com/t5/Splunk-Search/Reporting-on-deviceIDs-that-return-no-results-for-a-specific/m-p/20593#M177303 <P>Hello,</P> <P>I'm trying to write a search query that will return the number of 'IntervalReadingEvent' per deviceID. I've got a full list of my deviceIDs in a lookup but my search will only ever return the count of 'IntervalReadingEvent' for deviceIDs that have at least one of the 'IntervalReadingEvent' results.</P> <P>Example search: <BR /> <CODE>index="MyIndex" IntervalReadingEvent | lookup MyLookup deviceId OUTPUT MAC_Address | stats count by MAC_Address</CODE></P> <P>That seems to work fine and will return a list of all the <CODE>MAC_Addresses</CODE> and the count of how many IntervalReadingEvents they have had. The problem is a <CODE>MAC_Address</CODE> must have at least 1 result to show up in my list. I want ALL the <CODE>MAC_Addresses</CODE> in my lookup file to be show in the results and show '0' if they have had no IntervalReadingEvents in the last X minutes.</P> <P>My goal is to find the lack of a particular type of event over X minutes for my list of deviceIDs.</P> <P>Thank you.</P> Tue, 05 Feb 2013 18:52:52 GMT kyle_ross 2013-02-05T18:52:52Z https://community.splunk.com/t5/Splunk-Search/Reporting-on-deviceIDs-that-return-no-results-for-a-specific/m-p/20593#M177303 <P>Hello,</P> <P>I'm trying to write a search query that will return the number of 'IntervalReadingEvent' per deviceID. I've got a full list of my deviceIDs in a lookup but my search will only ever return the count of 'IntervalReadingEvent' for deviceIDs that have at least one of the 'IntervalReadingEvent' results.</P> <P>Example search: <BR /> <CODE>index="MyIndex" IntervalReadingEvent | lookup MyLookup deviceId OUTPUT MAC_Address | stats count by MAC_Address</CODE></P> <P>That seems to work fine and will return a list of all the <CODE>MAC_Addresses</CODE> and the count of how many IntervalReadingEvents they have had. The problem is a <CODE>MAC_Address</CODE> must have at least 1 result to show up in my list. I want ALL the <CODE>MAC_Addresses</CODE> in my lookup file to be show in the results and show '0' if they have had no IntervalReadingEvents in the last X minutes.</P> <P>My goal is to find the lack of a particular type of event over X minutes for my list of deviceIDs.</P> <P>Thank you.</P> Tue, 05 Feb 2013 18:52:52 GMT https://community.splunk.com/t5/Splunk-Search/Reporting-on-deviceIDs-that-return-no-results-for-a-specific/m-p/20593#M177303 kyle_ross 2013-02-05T18:52:52Z https://community.splunk.com/t5/Splunk-Search/Reporting-on-deviceIDs-that-return-no-results-for-a-specific/m-p/20594#M177304 <P>You could start with inputlookup, loading all MAC_Addresses - and then join that with your search. Just remember to use a left join with a max other than 1.</P> Tue, 05 Feb 2013 20:25:08 GMT https://community.splunk.com/t5/Splunk-Search/Reporting-on-deviceIDs-that-return-no-results-for-a-specific/m-p/20594#M177304 martin_mueller 2013-02-05T20:25:08Z