Can you help me with input lookup, tstats, and visualization?

[maryamchar]

Hello,

I have a lookup table for all the source types. I'm trying to use stats or tstats to show all the source types, and if they have no data coming, I want to show 0 for those source types. I'm having trouble using the tstats or time chart; it's only working with chart now. IS there a way to solve this problem?

Please help, thank you!

This is what I have now:

index=* |chart count by Sourcetype |append [inputlookup "Sourcetype.csv" |eval count=0 ]  

*** I would like to have timechart or tstats because I'm trying to use Trellis visualization***

[chrisyounger]

This is a really hard problem to try and write your own queries to solve. You should take a look at the MetaWoot app https://splunkbase.splunk.com/app/2949/ as it does a great job of this stuff. You can also just pull the queries out of that app if you want.