title: Splunk query to get all counts including events (_raw) where match does not exist
body: <p>How do I get a count of all records for a given field including a count of all records where the field does not exist.  </p>
  
  <p>For example:</p>
  
  <p>Given data that generally looks something like this:</p>
  
  <pre><code>{"source_host":"host1", "msg":"some message", "user":"jack"}
  {"source_host":"host2", "msg":"some other message", "user":"jill"}
  </code></pre>
  
  <p>I can get a count of all records like this:</p>
  
  <pre><code>index="my_index" sourcetype=my_proj:my_logs | table _raw | stats count(_raw)
  </code></pre>
  
  <p>I can get a count of records for a given field like this:</p>
  
  <pre><code>index="my_index" sourcetype=my_proj:my_logs | stats count(_raw) by source_host
  </code></pre>
  
  <p>Gives a table like this</p>
  
  <pre><code>host       count
  host_1     89
  host_2     57
  </code></pre>
  
  <p>But I would like the query to also count records where the field exists but is empty, like this:</p>
  
  <pre><code>{"source_host":"", "msg":"some message", "user":"jack"}
  </code></pre>
  
  <p>And also count messages like this:</p>
  
  <pre><code>asdf asdf asdf asdf asd fasdfasdfafas 
  foo bar
  Some other Junk someone wrote to my log
  </code></pre>
  
  <p>To get a table like this</p>
  
  <pre><code>host       count
  host_1     89
  host_2     57
  null       1
  no_def     3
  </code></pre>