LOOKUP and NULL values

[shelleysm]

Hello, I am new-ish to Splunk and had a question regarding the use of a lookup table and wanting to include all values listed in a lookup table in search output even when there are no events related.  To summarize, I have a lookup file that correlates a server name with an environment name:

host, EnvName

server1, EnvA

server2, EnvB

serverN,EnvN...

I am trying to show the number of events per day per server and my issue is that when there are no events for a server during the timeframe, the server is not listed in the output.  

index=index_name sourcetype=sourcetype_name | lookup lookup_name host OUTPUT EnvName | chart count by ....

With this search, only values with events will be returned.  Is there a way to include the values in the lookup that do not have any events during this timeframe?  Thanks.

[ITWhisperer]

Try something like this (untested)

index=index_name sourcetype=sourcetype_name 
| stats count by ....
| inputlookup append=t lookup_name 
| fillnull value=0 count 
| rename host as EnvName 
| chart sum(count) as count by ....

You might need additional renames and/or fillnulls depending on your data/lookup table, but essentially you are appending zero counts for everything in your lookup and then adding these to the existing counts (if there were any)