Hi Everyone: I have this query on which is comparing the file from last week to the one of this one. I'm doing this to bring new events by date, but when there is no results found it is no showing me the Date and a 0, and I need this line to append it to another lookup.
| inputlookup append=t NEW.csv | lookup OLD.csv UniqueID OUTPUTNEW UniqueID as NEW | where like(ISSUE,"%Wrong%") | where isnull(NEW) | stats count as New_event by DATE_REPORT | eval Date=strftime(strptime(DATE_REPORT, "%Y-%m-%d %H:%M:%S"), "%m-%d-%Y") | fields Date New_event
I would like to get something like this:
Date New_event 6-23-2022 0
... View more