appen empty values to results in lookup

[bluewizard]

I have the following search to track search usage, i have a list of user who i want to track in a csv file. However, how do I add values that are in csv but not in my base search?  As in my base search some users are have 0 count. 

im getting the following:

username|count

userA|100

userB|200

I would like to add missing user name in the lookup to my results like below:

username|count

userA|100

userB|200

userC| 0

userD| 0

| tstats `summariesonly` count from datamodel=Splunk_Audit.Search_Activity where (Search_Activity.info="granted" OR (Search_Activity.info="completed" Search_Activity.search_type="subsearch"))    by Search_Activity.user | rename Search_Activity.* as * | sort  + count
| lookup ess_analyst_list.csv username as user OUTPUT username as users
| where !isnull(users)
| fields - users

[PickleRick]

Splunk cannot find what is not there 🙂 So you have to provide it with a "synthetic" values.

https://www.duanewaddle.com/proving-a-negative/

[bluewizard]

User C and User D is in the lookup (csv), anyway to add them if their are not in my base search and eval as "0"