How to compare my search result with saved data list to reflect the value not reflecting in the search result (that is there in the saved data list)?

[IamRoni]

My existing search string is:

index="os" OR index="app"  host=ip-10-12-70-56.va2.b2c.nike.com sourcetype=ps| multikv fields ARGS filter java| rex "Db2cid\=(?<b2cid>job-\\w+..)_" | dedup b2cid,host | chart count by b2cid,host | eval b2cidlowr=lower(b2cid) | sort  b2cidlowr | fields - b2cidlowr

This search is returning hosts like the following:

job-AsyncReqAgentServer-0   
job-CloseOrderAgentServer-0 
job-CreateOrderJMSServer-0  
job-CreateShipmentInvoiceJMSServer-0
job-FraudResponseJMSServer-0

But I have another couple of host which ideally should have reflected but not reflecting.
If I declare all the possible hosts in the search, can it return the hosts that are not getting rendered?
How to write such a search string?

[woodcock · Accepted solution]

Yes, you can declare them all in a list and attach this to your search like this:

| noop | stats count AS host | eval host="host1,host2,host3,host4,hostn" | eval b2cid="dummy" | makemv delim="," host | mvexpand host |append [index="os" OR index="app"  host=ip-10-12-70-56.va2.b2c.nike.com sourcetype=ps| multikv fields ARGS filter java| rex "Db2cid\=(?<b2cid>job-\\w+..)_" | dedup b2cid,host] | chart count by b2cid,host | eval b2cidlowr=lower(b2cid) | sort  b2cidlowr | fields - b2cidlowr

[IamRoni]

Thanks a lot woodcock.
With some enhancement its fitting my requirements
Appreciate it!

[IamRoni]

@woodcock
was unable to find the proper explanation on noop command. Can you please guide me on this?

[woodcock]

It is short for "NO OPeration". It is a command that does not require an input and does nothing put pass-through events. It is the most efficient way to create an empty event-set, which, when piped to stats count gives us a single event that we can manipulate to create other events.