HI,   I guess that when you use the "| dedup Username" you are removing all duplicate entries of users.   As an example, if user "John" uses app A and app B, dedup command will return only one of these apps. I think the best approach for the unique users per application is to use the "| stats dc()".   You can try something like: index="autodesk-licensing" | lookup autodesklicenses.csv Feature AS product OUTPUT FriendlyName AS "product" | rename "product" AS "Application", "username" AS "Username", "lichost" AS "Hostname" | addtotals | stats dc(Username) as "Total Unique Users" by "Application"   ... View more