I'm trying to match all domains from a lookup file with a base search and get a count of the events for each one even if there are no events matching (0 count): mysite.com  count 12 anothersite.com count 5 myothersite.com count 0         index=application sourcetype=mysource | lookup myfile.csv Domain as <corelated event field> | append [ | inputlookup myfile.csv | fields Domain] | stats count as total by Domain | fillnull value=0 total | table total | sort -total         If you can, please explain your answer - whether there is a syntax error, a keyword misuse, or conceptual error on my part.  ... View more