Give this a try (adding dummy rows with 0 count for all msgId_short that you may get, then taking the max count. Anything missing in main search result will show 0 count) index=app sourcetype=ELP99 host="CHeapp*" source="C:\\TPFiles\\LogFile*.log" sourcetype="etp99" msgId=LS-* OR msgId=LAS-* OR msgId=LSP-* OR msgId=LRS-* | rex field=msgId "(?<msgId_short>.*)-" | stats dc(serverName) as ServerInRotation by msgId_short | append [| gentimes start=-1 | eva msgId_short="LAS LSP LRS" | table msgId_short | makemv msgId_short | mvexpand msgId_short | eval ServerInRotation=0 ] | stats max(ServerInRotation) as ServerInRotation by msgId_short ... View more