How to append text in field on result not found

[Lukas972]

Let's suppose I have TOTO in successfully in my logs. I want to display the result for TOTO and append that no result found for TITI and TUTU with linecount=0 and their name in UNIT.

Somebody can help me ?

| search "successfully"
| makemv delim="," _raw
| table host, unit, linecount
| stats count by unit | where unit IN ("TOTO",TITI",TUTU")
| append [ ... I'm bugging ... ]

If there is another way to loop on value, I'm open. I didn't found how to declare and use variable exept with token ...

[PickleRick · Accepted solution]

There is no "looping" as such in Splunk. You can iterate over the fields in results but that's it. Yes, with some clever trick you can (ab)use this functionality to do "paraprogramming" but that's not what Splunk is about.

See my response to https://community.splunk.com/t5/Splunk-Search/Need-to-display-count-having-zero-events/m-p/565220

[Lukas972]

Thanks, It work !

That's my new code :

<query>
index=mysourcelog "successfully" unit IN ($units_tok$)
| stats by unit
| append [ | makeresults
| eval _raw="TOTO
TUTU
TITI"
| multikv noheader=t
| rename Column_1 as unit
| stats sum(count(linecount)) by unit
</query>
<option name ="drilldown">cell</option>
<drilldown>
 <set token="units_tok">"TOTO","TITI","TUTU"</set>
</drilldown>

I understand now that i need to have another approch of Splunk ... I will try to variabilize the content for multikv.