i want to show the count from host as zero if the process is not found however not able to find 0 count the host disappears if process is not found
index=oslogs sourcetype=ps COMMAND="process1"
|stats count by host,COMMAND
result :-
host1 java 12
host2 java 3
host4 java 4
Expected result
host1 12
host2 3
host3 0
host4 4
The stats command cannot count what isn't there. It can't fill in missing values because the set of possible missing values is infinite. You have to have a list of possible host names and use that to insert zeroes for missing hosts. See this blog entry for a good write-up on it.
https://www.duanewaddle.com/proving-a-negative/