Hello, I am new-ish to Splunk and had a question regarding the use of a lookup table and wanting to include all values listed in a lookup table in search output even when there are no events related. To summarize, I have a lookup file that correlates a server name with an environment name: host, EnvName server1, EnvA server2, EnvB serverN,EnvN... I am trying to show the number of events per day per server and my issue is that when there are no events for a server during the timeframe, the server is not listed in the output. index=index_name sourcetype=sourcetype_name | lookup lookup_name host OUTPUT EnvName | chart count by .... With this search, only values with events will be returned. Is there a way to include the values in the lookup that do not have any events during this timeframe? Thanks.
... View more