Splunk Search

display lookup file data even if count is zero

marellasunil
Communicator

I have uploaded CSV file contains service names, the query which ever I am runing is not displaying the services names, if count is zero.
Ex : csv file contain row name Service_name and values service1, service2, service3, service4 ... service 50
I have added the row name in extract fields as service_name,
If I use the command ".. | chart count by service_name", it is not displying the values equal to 0 however I am getting the results for other services which ever is not zero.

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Before your chart command, append the lookup file like this:

... | append [inputlookup <your lookup here>] | chart ...

Then reduce the count by one for each service name to account for the extra events appended.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Before your chart command, append the lookup file like this:

... | append [inputlookup <your lookup here>] | chart ...

Then reduce the count by one for each service name to account for the extra events appended.

marellasunil
Communicator

Used field - NULL..
XML used inputlookup ..
worked there too...
It worked fine. Thanks Martin....
:-)

0 Karma

marellasunil
Communicator

Hi,

Small modification, I have to do. I have to calculate status as well.
... | append [inputlookup service.csv] | chart count over service_name by status
I am getting a coulmn NULL if I run the query and alsi in XML also counting as NULL.
Can you please suggest what can I do for this.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...