One way to do it is this | makeresults format=csv data="location, name
location A, name A2
location B, name B1
location B, name B2
location C, name C1
location C, name C2
location C, name C3"
| se...
See more...
One way to do it is this | makeresults format=csv data="location, name
location A, name A2
location B, name B1
location B, name B2
location C, name C1
location C, name C2
location C, name C3"
| search name != "*2*"
| stats count by location
| append
[| makeresults format=csv data="location, name
location A, name A2
location B, name B1
location B, name B2
location C, name C1
location C, name C2
location C, name C3"
| eval count=0
| fields location count
| dedup location]
| stats sum by location but as @PickleRick said, Splunk is not good with non existent values. r. Ismo