OK, so this is your search so far... (please use the code sample option to paste in your search code </>)
| tstats values(Arcgis.email) as email, values(Arcgis.agency) as Agency, values(Arcgis.mapservice) as Data, count(Arcgis.mapservice) as Datacount, values(Arcgis.mapfolder) as Mapfolder from datamodel=Arcgis where (host=URASVR334) groupby _time Arcgis.email
| search
[ tstats values(Eplanner.loginname) as email from datamodel=Eplanner
| table email] NOT Mapfolder=*ONETOOL* NOT Mapfolder=*GEMMA* NOT Mapfolder=*Scenarios* NOT Mapfolder=*USDashboard* NOT Mapfolder=*EPAC* NOT Mapfolder=*CLI* NOT Mapfolder=*MP14* NOT Data=*_3414*
| eval Email=upper(email)
| append
[| tstats values(Eplanner.email) as Email, values(Eplanner.agency) as Agency, values(Eplanner.layers) as Data, count(Eplanner.layers) as Datacount from datamodel=Eplanner groupby _time Eplanner.email
| eval Email=upper(Email)]
| append
[| tstats values(Eplanner.email) as Email, values(Eplanner.agency) as Agency, values(Eplanner.typename) as Data, count(Eplanner.typename) as Datacount from datamodel=Eplanner groupby _time Eplanner.email
| eval Email=upper(Email)]
| lookup eplannerusers.csv "Login Name" as Email OUTPUT "Login Name" Date Group as Group Department Designation "Full Name" as Fullname
| strcat Fullname " / " Department Name_Dept
| search Agency=Potato Hero Email=TAN@potato.hero.sg Data=AreaOIC
| where !isnull(mvfind(Data, "AreaOIC"))
| stats values(Fullname), values(Designation), values(Name_Dept), values(Group), values(Department), values(Agency), values(Mapfolder), values(Data), sum(Datacount) by Email
You Data field comes from
First line of search = values(Arcgis.mapservice) as Data
First append line = values(Eplanner.layers) as Data
Second append line = values(Eplanner.typename) as Data
so, you have types of 'Data' that may appear. Consider now
| search Agency=Potato Hero Email=TAN@potato.hero.sg Data=AreaOIC
This line will, in theory only include Data values that are AreaOIC
so if you remove all of your search after that, how many rows (events) do you end up with and what are the values of Data?
Note that your search command is most likely bad, in that I suspect you should really be quoting
Agency="Potato Hero", otherwise you are searching for Agency=Potato and then you are searching for the word Hero
Please share what results you get from the above and what the real values of Data in each event are