Here's an approach I've used for a similar problem.
Look at this example:
| makeresults
| eval Possible_ORs="2E,PE,PN,TE,TN,XX,SA,AE" | eval Possible_ORs = split(Possible_ORs,",") | mvexpand Possible_ORs | eval Count=0 | rename Possible_ORs as ORs
| fields - _time
| append
[ | makeresults
| eval ORs="AU,NY,PN,TE,AE,XX,ID" | eval ORs = split(ORs,",") | mvexpand ORs
| eval Count = 20 | fields - _time ]
| dedup ORs sortby - Count
So the first 'makeresults' section just sets up a default list of results in your list. In this case, it would be all the possible ORs with a Count of 0. You can add extra default fields as needed. If you have a list of ORs in an index, you can create a 'real' search that just returns the possible ORs and adds a default of 0.
The subsearch after the append is where you put your "real" search to pull back all of the available counts for different ORs that exist in the data. In my example, I just did another 'makeresults' and gave each a count of 20.
So both of these results sets (the original default Count of 0, and the set of real counts) is appended together, and all that's left is to dedup the set. With a 'sortby - Count' clause if the OR appears twice in the set, the dedup will preserve the higher real Count value and drop the one with 0.
... View more