Reporting on deviceIDs that return no results for a specific search

[kyle_ross]

Hello,

I'm trying to write a search query that will return the number of 'IntervalReadingEvent' per deviceID. I've got a full list of my deviceIDs in a lookup but my search will only ever return the count of 'IntervalReadingEvent' for deviceIDs that have at least one of the 'IntervalReadingEvent' results.

Example search:
index="MyIndex" IntervalReadingEvent | lookup MyLookup deviceId OUTPUT MAC_Address | stats count by MAC_Address

That seems to work fine and will return a list of all the MAC_Addresses and the count of how many IntervalReadingEvents they have had. The problem is a MAC_Address must have at least 1 result to show up in my list. I want ALL the MAC_Addresses in my lookup file to be show in the results and show '0' if they have had no IntervalReadingEvents in the last X minutes.

My goal is to find the lack of a particular type of event over X minutes for my list of deviceIDs.

Thank you.

[martin_mueller]

You could start with inputlookup, loading all MAC_Addresses - and then join that with your search. Just remember to use a left join with a max other than 1.