Want to display count as zero in statistics when there is no events for a IP.

[sathiyasun]

index=bc cs_host="collector" NOT 10.xx,xxx.121 c_ip=10.xx.xxx.233 OR c_ip=10.xx.xxx.234 OR c_ip=10.xx.xxx.248 OR c_ip=10.xx.xxx.250 OR c_ip=10.xx.xxx.42 OR c_ip=10.xx.xxx.43
|stats count by c_ip

It only display the count which has event, how could i force in search to display zero there is no data/event for an IP.
The screenshot display only the IP which has results but not showing which didnt have data/event.

[grittonc · Accepted solution]

I don't see a way to do this without telling Splunk the IPs that you want to see in your output. Give this a try:

index=bc cs_host="collector" NOT 10.xx,xxx.121 c_ip=10.xx.xxx.233 OR c_ip=10.xx.xxx.234 OR c_ip=10.xx.xxx.248 OR c_ip=10.xx.xxx.250 OR c_ip=10.xx.xxx.42 OR c_ip=10.xx.xxx.43 
|stats count by c_ip
| append
[| makeresults 
    | eval c_ip="10.xx.xxx.233, 10.xx.xxx.234, 10.xx.xxx.248, 10.xx.xxx.250, 10.xx.xxx.42, 10.xx.xxx.43" , count=0
    | makemv c_ip delim=", " 
    | mvexpand c_ip 
    | table c_ip, count]
| stats sum(count) as count by c_ip

If this works for you, you could skip the makeresults step by creating a lookup table with the IP addresses that you want, but you might not want that if you frequently change the list that you want.