i am getting two diffrent results in total. query1 is providing acurate result.  query2 as soom as adding |lookup locationdetails.csv City AS City total value to less than acurate one using splunk version 7.3.71 query1 index=xyz source=xyz  |eval Month=strftime(_time,"%b %Y") |search Month="Mar 2021" |search Product In (Sold,Damaged) |stats count(Product) as Total  query 2 index=xyz source=xyz  |eval Month=strftime(_time,"%b %Y") |search Month="Mar 2021" |search Product in (Sold,Damaged) |lookup locationdetails.csv City AS City |stats count(Product) as Total  ... View more

Citry contains 12 names. in result i am able to see only city name with product if product is zero it is not showing the Citry name base search |stats count(product) AS Total BY City |fillnull value=0 City Citry Total citry1 1 citry5 50 citry10 15 expectation  Citry Total citry1 1 citry2 0 citry3 0 citry4 0 citry5 50 citry6 0 citry7 0 citry8 0 citry9 0 citry10 15 citry11 0 citry12 0 ... View more

Hi, want to achieve daily,weekly ,monthly,  yearly report empDirectory.csv contains Employee ID,Employee  Name, Manager ,ManagerID one.CSV contains Date1 and EMP_ID1 Two.csv contains Date2 and EMP_ID2 want to compare employee from Two.csv  is present in one.csv on particular date.  below is my query.  | inputlookup one.CSV |dedup EMP_ID1,Date |lookup empDirectory.csv EMP_ID as EMP_ID1 |search ManagerID=Manager1 |table Date1,EMP_ID1,ManagerID |join [ inputlookup two.CSV |dedup EMP_ID2, Date2 |lookup empDirectory.csv EMP_ID as EMP_ID2 |search ManagerID=Manager1 |table Date2,EMP_ID2] |table Date1,EMP_ID1,ManagerID,Date2,EMP_ID2 |eval GoodEMP=if(EMP_ID1=EMP_ID2, "Good", "NotGood") |search GoodEMP=GoodEMP |table GoodEMP,Employee ID,Employee  Name, Manager ,ManagerID extending above query to timechart |timechart count(GoodEMP) as GoodEMP by Date2 expected result Total number of GoodEMP per day under manager  want to create monthly,weekly, yearly graph  ... View more