I have a pie chart that works great with a current search. I have been asked to add something to the pie chart that is not contained in the current search/source. The current search takes a list and finds how many times each unique serial number shows up. So my current search for my pie chart that works looks like:
sourcetype=mysource NOT "Device Name" | stats count by sn | rangemap field=count "min" 1-2 " Mod" 2-3 "High" 4-1000 | stats count by range
So I need to add serial numbers that are not showing up in my original search that are contained in another sourcetype. This sourcetype only contains text file of serial numbers. Some how I need to read that list, find what serial numbers are in that list and not being used in my current chart, and then add that number to my chart under rangemap with something like "low" 0. Any ideas how I can make that happen all in one search?
