Why are there missing results using different Search query codes?

[bogdan_nicolesc]

So i have this:

(index=* OR index=_*) (index="GA2014" EventCode=4625)
| dedup RecordNumber
| rename Account_Name AS EventObject.Account_Name  EventCode AS EventObject.EventCode 
| stats dedup_splitvals=t count AS "Count of Event Object"  by "EventObject.Account_Name" 
| sort limit=100000 "EventObject.Account_Name" 
| fields - _span  
| rename "EventObject.Account_Name" AS Account_Name  
| fillnull "Count of Event Object" 
| fields Account_Name, "Count of Event Object"
| search NOT Account_Name="-"

Resulting into this:

+--------------+-----------------------+
| Account_Name | Count of Event Object |
+--------------+-----------------------+
| SQLSERVICE   |                     1 |
+--------------+-----------------------+
| STAFF        |                     1 |
+--------------+-----------------------+
| STUDENT      |                     1 |
+--------------+-----------------------+
| SUPORTE      |                     1 |
+--------------+-----------------------+
| SUPPORT      |                     2 |
+--------------+-----------------------+
| SYMANTEC     |                     1 |
+--------------+-----------------------+

!!!!WITH!!!!

These 3 over here:

+---------------+-----------------------+
| Account_Name  | Count of Event Object |
+---------------+-----------------------+
| АДМИН         |                     8 |
+---------------+-----------------------+
| АДМИНИСТРАТОР |                     8 |
+---------------+-----------------------+
| ПОЛЬЗОВАТЕЛЬ  |                     8 |
+---------------+-----------------------+

!!BUT!!
When i do a search like this:

(index=* OR index=_*) (index="GA2014" EventCode=4625)
| dedup RecordNumber
| rename Account_Name AS EventObject.Account_Name EventCode AS EventObject.EventCode Workstation_Name AS EventObject.Workstation_Name
| bucket _time  span=1s 
| stats dedup_splitvals=t values("EventObject.EventCode") AS "Distinct Values of EventCode"  by _time, "EventObject.Account_Name", "EventObject.Workstation_Name", "EventObject.EventCode" 
| sort limit=10000000 _time 
| rename "EventObject.Account_Name" AS Account_Name "EventObject.EventCode" AS EventCode "EventObject.Workstation_Name" AS Workstation_Name
| fields _time, Account_Name, Workstation_Name, "Distinct Values of EventCode"
| search NOT Account_Name="-"

I get this:

+---------------------+--------------+------------------+------------------------------+
| _time               | Account_Name | Workstation_Name | Distinct Values of EventCode |
+---------------------+--------------+------------------+------------------------------+
| 2020-02-21 01:03:48 | Demo         | workstation      |                         4625 |
+---------------------+--------------+------------------+------------------------------+
| 2020-02-21 01:05:57 | Reception    | workstation      |                         4625 |
+---------------------+--------------+------------------+------------------------------+
| 2020-02-21 01:09:06 | User11       | workstation      |                         4625 |
+---------------------+--------------+------------------+------------------------------+
| 2020-02-21 01:10:34 | Ieuser       | workstation      |                         4625 |
+---------------------+--------------+------------------+------------------------------+

!!Without!!

АДМИН
АДМИНИСТРАТОР
ПОЛЬЗОВАТЕЛЬ

Nowhere to be seen in sight. Don't know right now if it applies only to these 3 or not, but i searched it with ctrl+f in browser and found nothing ....

Honestly, i don't know what name to give to this thread/question. Maybe i can get some advice on this too, if i will be able to rename my thread/question ....

P.S.: It's 2 in the mornin' over here, so if i have any typos, it must be the late hour ...