Hi @Orangebottle76 ,
let me understand:
in the lookup you have in a column the host and in another the count of hosts.
there could be sone hosts without values and you want to check this, is this correct?
if this is your need, as you can read in my answer linked by @SanjayReddy, you need a list of hosts to monitor to insert in another lookup (called e.g. perimeter.csv) containing at least one column with the same fieldname of the first lookup (e.g. host), so you can run a search like this:
| inputlookup your_lookup.csv
| eval host=lower(host)
| stats values(number) AS number BY host
| append [ | inputlookup perimeter.csv | eval host=lower(host), number=0 | fields host number ]
| stats sum(number) AS number BY host
in this way you'll have the number of all hosts, also the one not present in the main lookup but present in the perimeter.csv.
Ciao.
Giuseppe
