Hello,
I have a lookup table for all the source types. I'm trying to use stats or tstats to show all the source types, and if they have no data coming, I want to show 0 for those source types. I'm having trouble using the tstats or time chart; it's only working with chart now. IS there a way to solve this problem?
Please help, thank you!
This is what I have now:
index=* |chart count by Sourcetype |append [inputlookup "Sourcetype.csv" |eval count=0 ]
*** I would like to have timechart or tstats because I'm trying to use Trellis visualization***
↧