Adding new expected Value to serach result

[mikroice90]

Hi,

I tried search some data from logs using this statement:

index=* sourcetype="mySource" Types* | stats count by Types 

in result I receive table like this:

Type1	5
Type2	4
Type3	1

I know that in the future in logs can occur Type4 so I would like to add it in to serach result by force. I tried some lookup stuff but i cant use it properly to get expected result.

So for now I would like to have table like this:

Type1	5
Type2	4
Type3	1
Type4	0

Thanks in advice for help.

[inventsekar]

Hi @mikroice90 .. maybe, check this idea -
EDIT - using eval, we can check if type4 exist, if its null, assign a zero value.

index=* sourcetype="mySource" Types* | eval type4=if(isnull(type4),0,type4) | stats count by Types 

[mikroice90]

• @inventsekar  how it works in case: when logs with type4 will exist? It will still shows 0 instead of count value?

[inventsekar]

Hi @mikroice90 

the if condition is checking if type4 is null, then it adds type4=0, if it is not null, then it will take the current value of type4. 

[mikroice90]

Brilliant, thanks a lot

One more question, This strings "Type1,Types2" etc. exist in more than one field in data set. Is it possible to count it all together instead of counting only by Types?

[isoutamo]

Please send example of events, so we could help you easier.
r. Ismo