https://community.splunk.com/t5/Splunk-Search/Issues-with-Sum-count-not-showing-a-number-but-total-being/m-p/273035#M176778 <P><CODE>values</CODE> has an implicit dedup. Since both counts are 1, its gets deduped. Try using <CODE>list</CODE> instead.</P> <PRE><CODE>index=location |search LockedStatus=Locked |rename UserAccountEntry as User |stats count by Location User | stats list(User) as User list(count) as PerUser_count sum(count) as Total by Location | sort 10 -Total </CODE></PRE> Fri, 09 Sep 2016 13:28:21 GMT sundareshr 2016-09-09T13:28:21Z https://community.splunk.com/t5/Splunk-Search/Issues-with-Sum-count-not-showing-a-number-but-total-being/m-p/273034#M176777 <P>Have a search that gives data, for "yesterday" with specific criteria. Trying to show results by Location, with counts by user per location. I get the counts, but it sometimes does not show a count.</P> <P>Search is this. (data changed to protect the innocent <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> )</P> <P>index=location |search LockedStatus=Locked |rename UserAccountEntry as User |stats count by Location User | stats values(User) as User values(count) as PerUser_count sum(count) as Total by Location | sort 10 -Total</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/1824i43B33857571632ED/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>If you look at DEF, for the 1258452 there is not a 1 in the per user count. Thoughts on why? (this happens every day, though location or user is different).</P> <P>Thanks</P> Fri, 09 Sep 2016 12:32:06 GMT https://community.splunk.com/t5/Splunk-Search/Issues-with-Sum-count-not-showing-a-number-but-total-being/m-p/273034#M176777 bworrellZP 2016-09-09T12:32:06Z https://community.splunk.com/t5/Splunk-Search/Issues-with-Sum-count-not-showing-a-number-but-total-being/m-p/273035#M176778 <P><CODE>values</CODE> has an implicit dedup. Since both counts are 1, its gets deduped. Try using <CODE>list</CODE> instead.</P> <PRE><CODE>index=location |search LockedStatus=Locked |rename UserAccountEntry as User |stats count by Location User | stats list(User) as User list(count) as PerUser_count sum(count) as Total by Location | sort 10 -Total </CODE></PRE> Fri, 09 Sep 2016 13:28:21 GMT https://community.splunk.com/t5/Splunk-Search/Issues-with-Sum-count-not-showing-a-number-but-total-being/m-p/273035#M176778 sundareshr 2016-09-09T13:28:21Z