Hello,
I'm trying to write a search query that will return the number of 'IntervalReadingEvent' per deviceID. I've got a full list of my deviceIDs in a lookup but my search will only ever return the count of 'IntervalReadingEvent' for deviceIDs that have at least one of the 'IntervalReadingEvent' results.
Example search:
index="MyIndex" IntervalReadingEvent | lookup MyLookup deviceId OUTPUT MAC_Address | stats count by MAC_Address
That seems to work fine and will return a list of all the MAC_Addresses
and the count of how many IntervalReadingEvents they have had. The problem is a MAC_Address
must have at least 1 result to show up in my list. I want ALL the MAC_Addresses
in my lookup file to be show in the results and show '0' if they have had no IntervalReadingEvents in the last X minutes.
My goal is to find the lack of a particular type of event over X minutes for my list of deviceIDs.
Thank you.
You could start with inputlookup, loading all MAC_Addresses - and then join that with your search. Just remember to use a left join with a max other than 1.