As @bowesmana exemplifies, putting your complete set of values in a lookup is one way to count "missing" values. Another way to is to put them in an multivalued field and use this field for counting. Here is an example index=idx1 host=host1 OR host=host2 source=*filename*.txt field1!=20250106
(field2="20005") OR (field2="20006") OR (field2="20007") OR (field2="666")
| eval field2prime = mvappend("20005", "20006", "20007", "666")
| mvexpand field2prime
| eval field2match = if(field2 == field2prime, 1, 0)
| stats sum(field2match) as count by field2prime
| rename field2prime as field2 Here is an emulation you can play with and compare with real data: | makeresults count=16
| streamstats count as _count
| eval field2 = round(_count / 😎 % 3 + 20005
``` the above emulates
index=idx1 host=host1 OR host=host2 source=*filename*.txt field1!=20250106 (field2="20005") OR (field2="20006") OR (field2="20007") OR (field2="666")
``` Mock data looks like this: fiel2 20005 20005 20005 20006 20006 20006 20006 20006 20006 20006 20006 20007 20007 20007 20007 20007 If you count this against field2 directly, you get field2 count 20005 3 20006 8 20007 5 Using the above search, the result is field2 count 20005 3 20006 8 20007 5 666 0
... View more