Many fine examples on how to present stats results even if a zero output, but for some reason cannot get it to work in my environment. Not sure if there is a loop causing false output or not.
One of my users as created a lookup table that has only two columns: Location, ApplianceName. He created an "Automatic Lookup" using both field names, so both show up when executing a query against the index=proxies. All entries in the lookup table field ApplianceName have a match in the index. Only some of the entries in the lookup table field Location have a match.
What they want, is an event count from the index, by Location, and want zero to display where there are no events. Cannot seem to wrap my head around how to report on something that does not exist (i.e. the Location will not appear in the index).
'index=proxies Location=* | stats distinct_count(Location) = 16 Locations'
'| inputlookup proxy_appliances | stats count BY Location = 23 Locations'
How to I generated a list of events, per location, listing all 23 locations?
↧