Thank you - This worked for me however I have another issue based on these new results.
Before I was using a pivot table to manipulate this data. Very early in my development on these particular logs so I am playing with things. Using your method Iguinn, I see numbers populate with a 0 value for the number of calls. But because my CSV has all three "groups" it pulls zeros for every entry in the CSV that didn't pull a result... despite having specified a specific 'group' in my search. Currently, the way I see around this is to create 3 separate look ups for each group as opposed to one although I don't want to. Base on your method, how can I only display results from specific groups? Can I selectively pull info from a lookup?
My search:
index=ast sourcetype=poc_agi_logs number=* group="FAA" | stats count as Calls by location number group
| append [ inputlookup faadid.csv | eval Calls = 0 ] | stats sum(Calls) as Calls by location number group
My CSV (snipit)
location,number,group
UK,3785,FAA
SPAIN,5301,FAA
FRANCE,5081,FAA
ITALY,0025,FAA
UK,3786,FAB
SPAIN,5302,FAB
FRANCE,5082,FAB
ITALY,0026,FAB
UK,0615,EP
SPAIN,8165,EP
FRANCE,4984,EP
ITALY,0098,EP
Results for searching group FAA will return zeros for the locations and numbers in FAB and EP as well. I don't want that. Does that make sense?
... View more