How to edit my appencols search?

[sidekix24]

I'm having issues with this panel when using appendcols. Here's the search:

index="ai.snv.mon.query.25" ScanTime!="ScanTime" Product=an OR Product=s4 OR Product=buyer Filename="*is_up_on_*" Status="crit" | stats dc(Filename) AS Database by Product | appendcols[search index="ai.snv.mon.query.25" ScanTime!="ScanTime" Product=an OR Product=s4 OR Product=buyer Filename="*buyer_integrated_realms_front_door.query" OR Filename="*s4_integrated_realms_front_door.query"  | eval Nstatus=if(Status== "info", 0, 1) | stats dc(Filename) AS iFrontdoors by Product] | appendcols [search index="ai.snv.mon.query.25" ScanTime!="ScanTime" Product=an OR Product=s4 OR Product=buyer DataBlob="*uiHint: General*" Status="crit" | stats dc(Filename) AS Frontdoors by Product ] | table Product Frontdoors iFrontdoors Database

and here's the table that comes out:

The issue is that the "1" in iFrontdoors for "an" should be in the cell for "s4" and the an/ifrontdoor cell should be blank. Everything else lines up correctly. I've tried re-ordering the searches but that doesn't fix the issue. By process of elimination, when I take out the search for "iFrontdoors" the numbers line up correctly.

Anyone have any suggestions?

Thanks

[niketn]

If the issue is with the following query run the same in Verbose mode and validate the extracted Product field whether it is s4 or an. As per the stats I expect it to be an.

index="ai.snv.mon.query.25" ScanTime!="ScanTime" Product=an OR Product=s4 OR Product=buyer Filename="*buyer_integrated_realms_front_door.query" OR Filename="*s4_integrated_realms_front_door.query" | eval Nstatus=if(Status== "info", 0, 1) | stats dc(Filename) AS iFrontdoors by Product

PS: Seems like Nstats field is not used.

[sidekix24]

Running that search in Verbose mode brings back the correct product and count