https://community.splunk.com/t5/Splunk-Search/Using-stats-command-to-return-0-value/m-p/580266#M202185 <P>Hi There:</P><P>I'm trying to return the list of access_users with 0 web hits from the web_hits table.&nbsp;</P><P>How can i adjust this query to return the list of users with no hits from the web_hits table?</P><P>Thanks in advance!</P><P>&nbsp;</P><P>| inputlookup web_hits.csv<BR /><BR />| lookup local=t access_users.csv user OUTPUT user as access_user<BR /><BR />| search&nbsp;access_user="*"<BR /><BR />| stats count as num_webhits by access_user<BR /><BR /><BR /></P> Fri, 07 Jan 2022 14:07:36 GMT mdeterville 2022-01-07T14:07:36Z https://community.splunk.com/t5/Splunk-Search/Using-stats-command-to-return-0-value/m-p/580266#M202185 <P>Hi There:</P><P>I'm trying to return the list of access_users with 0 web hits from the web_hits table.&nbsp;</P><P>How can i adjust this query to return the list of users with no hits from the web_hits table?</P><P>Thanks in advance!</P><P>&nbsp;</P><P>| inputlookup web_hits.csv<BR /><BR />| lookup local=t access_users.csv user OUTPUT user as access_user<BR /><BR />| search&nbsp;access_user="*"<BR /><BR />| stats count as num_webhits by access_user<BR /><BR /><BR /></P> Fri, 07 Jan 2022 14:07:36 GMT https://community.splunk.com/t5/Splunk-Search/Using-stats-command-to-return-0-value/m-p/580266#M202185 mdeterville 2022-01-07T14:07:36Z https://community.splunk.com/t5/Splunk-Search/Using-stats-command-to-return-0-value/m-p/580267#M202186 <P>Maybe these answers helps you:</P><UL><LI><A href="https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-count-to-include-zero-count/m-p/403201" target="_blank">https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-count-to-include-zero-count/m-p/403201</A></LI><LI><A href="https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-count-to-include-zero-count-by-time/m-p/513537" target="_blank">https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-count-to-include-zero-count-by-time/m-p/513537</A></LI><LI><A href="https://community.splunk.com/t5/Splunk-Search/How-to-show-a-count-of-quot-0-quot-for-hosts-with-no-events-in/m-p/233578" target="_blank">https://community.splunk.com/t5/Splunk-Search/How-to-show-a-count-of-quot-0-quot-for-hosts-with-no-events-in/m-p/233578</A></LI></UL><P>More with&nbsp;<A href="https://www.google.com/search?client=safari&amp;rls=en&amp;q=site%3Acommunity.splunk.com+How+to+include+counts+with+0+events&amp;ie=UTF-8&amp;oe=UTF-8" target="_blank">site:community.splunk.com How to include counts with 0 events</A></P><P>r. Ismo</P> Fri, 07 Jan 2022 14:18:56 GMT https://community.splunk.com/t5/Splunk-Search/Using-stats-command-to-return-0-value/m-p/580267#M202186 isoutamo 2022-01-07T14:18:56Z https://community.splunk.com/t5/Splunk-Search/Using-stats-command-to-return-0-value/m-p/580268#M202187 <P>The <FONT face="courier new,courier">stats</FONT> command can't count what isn't there so you won't get a zero.&nbsp; This query returns those access_users that are not in the web_hits table.</P><LI-CODE lang="markup">| inputlookup local=t access_users.csv where NOT [| inputlookup web_hits.csv | fields user | rename user as access_user | format ]</LI-CODE><P>&nbsp;</P> Fri, 07 Jan 2022 14:29:07 GMT https://community.splunk.com/t5/Splunk-Search/Using-stats-command-to-return-0-value/m-p/580268#M202187 richgalloway 2022-01-07T14:29:07Z