There are a couple of ways. First, another answer has suggested using the metadata command, which is fine as long are you're just counting by host. If you're needing a more specific query, a count by host+source, or something else, that won't help you (though in version 6.0 you can doing things like | tstats count WHERE source=xyz GROUPBY host,source very quickly using any other indexed field, or you can similarly use an accelerated data model for more complex queries).
But I would say that you can just reverse the order in general:
index=x somekeywords | stats count by host | join host [ inputlookup server_list ]
This misses out any empty hosts, so you won't have zeros, though there are workarounds to this, like:
index=x somekeywords | append [ inputlookup server_list ] | stats count by host | eval count=count-1 | join host [ inputlookup server_list ]
This is really what you want, not to run the main search in a subsearch.
But really, the better answer for the functionality you want is simply a lookup, which you can configure as an auto lookup (see props.conf and transforms.conf) or inline:
index=x somekeywords | stats count by host | lookup server_list host
or
index=x somekeywords | append [ inputlookup server_list ] | stats count by host | eval count=count-1 | lookup server_list host
... View more
