Hi,
I'm trying to create a table that contains a list of tasks. The list is static and stored in a lookup table called tasks.csv.
So far I have the following search:
index=one OR index=two | rex field=_raw "^[0-9-:.\s]*\w+\s+(?<task>.*)" | stats count by task
| search [|inputlookup tasks.csv ]
This creates me a table that looks like this:
task
count
task_a
1
task_b
1
task_c
1
task_d
1
However, if a task in my static list does not appear in the search results, it does not show in the table. I want the table to contain the whole list of tasks, regardless of whether they appear in the search results or not.
i.e.
task
count
task_a
1
task_b
1
task_c
1
task_d
1
task_e
0
task_f
0
Any ideas on how I can do this?
The closest I've got is using a join.. which does work, but does not allow for a wildcard, meaning I'd need to specify the whole 'task'.
|inputlookup tasks.csv
| join type=left task [ | search index=one OR index=two | rex field=_raw "^[0-9-:.\s]*\w+\s+(?<task>.*)" | stats count by task]
| fillnull value=0 task
| table task count
Would appreciate any thoughts or suggestions. Thanks in advance.
... View more
