Splunk Search

show zero in count for stats command

venky1544
Builder

i want to show the count from host as zero if the process is not found however not able to find 0 count the host disappears if process is not found

index=oslogs sourcetype=ps COMMAND="process1"
|stats count by host,COMMAND

result :-

host1  java 12
host2  java 3
host4  java 4

Expected result
host1 12
host2 3
host3 0
host4 4

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The stats command cannot count what isn't there.  It can't fill in missing values because the set of possible missing values is infinite.  You have to have a list of possible host names and use that to insert zeroes for missing hosts.  See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...