Hello,
I have a lookup table for all the source types. I'm trying to use stats or tstats to show all the source types, and if they have no data coming, I want to show 0 for those source types. I'm having trouble using the tstats or time chart; it's only working with chart now. IS there a way to solve this problem?
Please help, thank you!
This is what I have now:
index=* |chart count by Sourcetype |append [inputlookup "Sourcetype.csv" |eval count=0 ]
*** I would like to have timechart or tstats because I'm trying to use Trellis visualization***
This is a really hard problem to try and write your own queries to solve. You should take a look at the MetaWoot app https://splunkbase.splunk.com/app/2949/ as it does a great job of this stuff. You can also just pull the queries out of that app if you want.