Create dash with predefined row labels

[ShagVT]

Hi folks, I'm trying to put together a dash that will help me find MISSING values.  So I would like to put together a chart that has rows based on values from a CSV, even if the record has no value.

So let's say the data are something simple like this:

06:25     foo

06:27     bar

06:27     foo

06:27     foo

And then I want an output that looks like this:

Label        count

bar             1

foo             3

blah            0

Notice that there is no "blah" row in my sample data.  I would have a CSV with those three rows (in reality my file will have many rows).  I've never used inputlookup for something like this, and I'm wondering if it is even possible. 

Any help is most welcome!

[PickleRick]

Inputlookup is easy. Just do

| inputlookup <your.lookup.csv>

And you got yourself a nice table which you can pipe to any evals, stats or do any other transformation  you want.

The problem is finding the "misses". It really depends on what you want to do. Because if you just want to count some parsed fields, it's relatively easy, as per the solution thah Rich showed.

But if you want to do a fully blown search for each of the terms from the lookup, well that'd have to involve the | map [subsearch] operation and is going to be highly ineffective (especially if you have many rows in your lookup).

[richgalloway · Accepted solution]

Finding something that is not there is not Splunk's strong suit.  See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/

[ShagVT]

This is EXACTLY what I needed.  Thank you!