This is the classic proving the negative issue. Splunk will count events based on your search criteria. It's can't create new categories of result for things that are not there. You need to explicitly add the hosts into the final result table if they are not present in the first count. You can do something like this, which will add in zero values for your 4 hosts and then max the count for each host index=app-logs sourcetype=app-data source=*app.logs* host=appdatajs01 OR host=appdatajs02 OR host=appdatajs03 OR host=appdatajs04
|stats count by host
| appendpipe [
| where a=1
| makeresults
| fields - _time
| eval host=split("appdatajs01,appdatajs02,appdatajs03,appdatajs04",",")
| mvexpand host
| eval count=0
]
| stats max(count) as count by host
| where count<100 Note that your statement "|bin span=1m _time" does nothing because you have no time field after the stats command Normally with this proving the negative technique, you would add all the hosts you are interested in into a lookup file and instead of appendpipe, use | inputlookup append=t host_lookup.csv
| fillnull count value=0
| stats...
... View more
