Issues with Sum(count) not showing a number, but total being correct.

[bworrellZP]

Have a search that gives data, for "yesterday" with specific criteria. Trying to show results by Location, with counts by user per location. I get the counts, but it sometimes does not show a count.

Search is this. (data changed to protect the innocent 🙂 )

index=location |search LockedStatus=Locked |rename UserAccountEntry as User |stats count by Location User | stats values(User) as User values(count) as PerUser_count sum(count) as Total by Location | sort 10 -Total

If you look at DEF, for the 1258452 there is not a 1 in the per user count. Thoughts on why? (this happens every day, though location or user is different).

Thanks

[sundareshr · Accepted solution]

values has an implicit dedup. Since both counts are 1, its gets deduped. Try using list instead.

index=location |search LockedStatus=Locked |rename UserAccountEntry as User |stats count by Location User | stats list(User) as User list(count) as PerUser_count sum(count) as Total by Location | sort 10 -Total