How to get a count difference when I add index=* to tstats?

[fredclown]

I'm logged into my system as an admin, so I have access to all the indexes. I've also verified this by looking at the admin role. It indeed has access to all the indexes. However, when I run the below two searches  I get different counts. I would think I should get the same count. The first one gives me a lower count. It's a pretty low volume dev system so the counts are low. They are different by about 20,000 events. I ran it with a time range of yesterday so that the counts wouldn't change. Does anyone have any thoughts on what could be causing this?

| tstats count ```the count was 95835```

vs

| tstats count where index IN (*) ```the counts was 115339```

[fredclown · Accepted solution]

Ok, I figured it out. It was a silly miss on my part. While my user had access to all the indexes only main was set as default, so leaving out the index only returned what went to main.