I have a query which results in a table: "some words" | stats dc(host) as host_count by zone, region My end goal is be able to create an alert if "host_count < 2" in any row. I will achieve that by adding " | where host_count < 2" to the query and alerting if the search is non-empty.   The issue is that in some cases, when there are no lines matching the  "some words" criteria, I will have no row for that zone/region combination in my table. (i.e. I will never have a row where host_count is 0). This will result in a false negative for the alert. I had the thought that I could possibly merge the search result with a lookup table which provides the 0 value lines, but had no success. How can I achieve this? ... View more