https://community.splunk.com/t5/Splunk-Search/show-zero-in-count-for-stats-command/m-p/571811#M199261 <P>i want to show the count from host as zero if the process is not found however not able to find 0 count the host disappears if process is not found</P><P>index=oslogs sourcetype=ps COMMAND="process1"<BR />|stats count by host,COMMAND</P><P>result :-</P><P>host1&nbsp; java 12<BR />host2&nbsp; java 3<BR />host4&nbsp; java 4</P><P>Expected result<BR />host1 12<BR />host2 3<BR />host3 0<BR />host4 4</P> Thu, 21 Oct 2021 12:57:43 GMT venky1544 2021-10-21T12:57:43Z https://community.splunk.com/t5/Splunk-Search/show-zero-in-count-for-stats-command/m-p/571811#M199261 <P>i want to show the count from host as zero if the process is not found however not able to find 0 count the host disappears if process is not found</P><P>index=oslogs sourcetype=ps COMMAND="process1"<BR />|stats count by host,COMMAND</P><P>result :-</P><P>host1&nbsp; java 12<BR />host2&nbsp; java 3<BR />host4&nbsp; java 4</P><P>Expected result<BR />host1 12<BR />host2 3<BR />host3 0<BR />host4 4</P> Thu, 21 Oct 2021 12:57:43 GMT https://community.splunk.com/t5/Splunk-Search/show-zero-in-count-for-stats-command/m-p/571811#M199261 venky1544 2021-10-21T12:57:43Z https://community.splunk.com/t5/Splunk-Search/show-zero-in-count-for-stats-command/m-p/571823#M199268 <P>The <FONT face="courier new,courier">stats</FONT> command cannot count what isn't there.&nbsp; It can't fill in missing values because the set of possible missing values is infinite.&nbsp;&nbsp;You have to have a list of possible host names and use that to insert zeroes for missing hosts.&nbsp; See this blog entry for a good write-up on it.<BR /><BR /><A href="https://www.duanewaddle.com/proving-a-negative/" target="_blank">https://www.duanewaddle.com/proving-a-negative/</A></P> Thu, 21 Oct 2021 13:49:19 GMT https://community.splunk.com/t5/Splunk-Search/show-zero-in-count-for-stats-command/m-p/571823#M199268 richgalloway 2021-10-21T13:49:19Z