Using stats command to return 0 value

[mdeterville]

Hi There:

I'm trying to return the list of access_users with 0 web hits from the web_hits table. 

How can i adjust this query to return the list of users with no hits from the web_hits table?

Thanks in advance!

| inputlookup web_hits.csv

| lookup local=t access_users.csv user OUTPUT user as access_user

| search access_user="*"

| stats count as num_webhits by access_user

[richgalloway]

The stats command can't count what isn't there so you won't get a zero.  This query returns those access_users that are not in the web_hits table.

| inputlookup local=t access_users.csv where NOT [| inputlookup web_hits.csv | fields user | rename user as access_user | format ]

[isoutamo]

Maybe these answers helps you:

• https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-count-to-include-zero-count/m-p/40320...
• https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-count-to-include-zero-count-by-time/m...
• https://community.splunk.com/t5/Splunk-Search/How-to-show-a-count-of-quot-0-quot-for-hosts-with-no-e...

More with site:community.splunk.com How to include counts with 0 events

r. Ismo