Showing table despite no result

[k31453]

Hi, I have base search which has appname field which lists all apps I have on splunk instance. I would like to output table or static in which it says whether apps a,b,c,d are present. If it is what it is version and what indexers are installed at. If there is no result found in base search, i would still like to see output as all a-d apps as absent status.

I already have base search :

index=.. host=... AND appname IN (a,b,c,d) 

k31453_0-1598417543439.png

[to4kawa · Accepted solution]

index=.. host=... AND appname IN (a,b,c,d) | append [|makeresults | eval appname=split("abcd","") |mvexpand appname | table appname] | dedup appname |table appname status version indexers |fillnull status value="Absent"

[richgalloway]

Finding something that is not there is not Splunk's strong suit.  See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/

[k31453]

This is not much helping as this is bit odd case.