I have a lookup table that lists all users along with their department like so:   email department --------------------------------------- user1@company.com Sales user2@company.com Engineering user3@company.com Accounting user4@company.com Sales user5@company.com HR     I also have an index that list events for a particular application. The index contains lots of fields, but for my purposes, I'm really only interested in _time and actor.email. My goal is to count the number of days per week every user in a given department logs events in the index even if that number is zero.  I can get pretty close to what I want with this search:   index=whatever <base search here> | lookup user.csv email as actor.email OUTPUT department | bin _time span=1d | search department="Sales" | stats count as numEvents by _time, actor.email | eval weekNumber = strftime(_time,"%U") | stats dc(_time) as numDays by actor.email, weekNumber | xyseries actor.email, weekNumber, numDays     The problem with this search is that if there is a user in the lookup table who returned zero events during that time frame, they won't appear in the results.  I considered trying to append [|inputlookup user.csv] to the search, but because my append doesn't include a _time field, I can't get everything to line up correctly.   How do I run a search for every user in the correct department in the lookup table and return zero events per week if they didn't interact with the system? ... View more