Stricter search gives me more results...what?

[rlough]

I have a query that looks like this

index=*ind* ((source=*src1.log field=NAME) OR (source=*src1.log field=STRING)) | eventstats count(eval(field=="NAME")) AS f1 count(eval(field=="STRING")) AS f2 by users | where f1 < 1 AND f2 > 0 | dedup users | table users

The above returns something like 2000 statistics, but when I remove AND f2 > 0 and query along the exact same timeframe I get around 100 less statistics.

Why would making a search stricter ever return more results? This doesn't make sense.

[hortonew · Accepted solution]

I think it might be treating that as a single expression rather than two separate expressions.

Either try: where (f1 < 1) AND (f2 > 0)
or
where f1 < 1 | where f2 > 0

and see what the results look like