So, you need to get back to basics. This is your most recent search: | tstats values(Arcgis.email) as email, values(Arcgis.agency) as Agency, values(Arcgis.mapservice) as Data, count(Arcgis.mapservice) as Datacount, values(Arcgis.mapfolder) as Mapfolder from datamodel=Arcgis where (host=URASVR334) groupby _time Arcgis.email
| search
[ tstats values(Eplanner.loginname) as email from datamodel=Eplanner
| table email] NOT Mapfolder=*ONETOOL* NOT Mapfolder=*GEMMA* NOT Mapfolder=*Scenarios* NOT Mapfolder=*USDashboard* NOT Mapfolder=*EPAC* NOT Mapfolder=*CLI* NOT Mapfolder=*MP14* NOT Data=*_3414*
| eval Email=upper(email)
| append
[| tstats values(Eplanner.email) as Email, values(Eplanner.agency) as Agency, values(Eplanner.layers) as Data, count(Eplanner.layers) as Datacount from datamodel=Eplanner groupby _time Eplanner.email
| eval Email=upper(Email)]
| append
[| tstats values(Eplanner.email) as Email, values(Eplanner.agency) as Agency, values(Eplanner.typename) as Data, count(Eplanner.typename) as Datacount from datamodel=Eplanner groupby _time Eplanner.email
| eval Email=upper(Email)]
| lookup eplannerusers.csv "Login Name" as Email OUTPUT "Login Name" Date Group as Group Department Designation "Full Name" as Fullname
| strcat Fullname " / " Department Name_Dept
| search Agency="Potato Hero" Email=Potato@Hero.potato.sg Data="AreaOIC" The field Data comes from the values of 3 different fields from 3 different tstats statements. You can't collect all the different fields then expect to somehow filter out the unwanted ones at the end of the search, particularly as you are combining the counts of these Data fields at each stage, so it's impossible to undo that further down your search. You will need to only search for your wanted Data field in each of the tstats statements, so you need to add the X="AreaOIC" filter criteria into each of your tstats statements, where you are collecting data, e.g. tstats ... values(Arcgis.mapservice) as Data .... where ... Arcgis.mapservice="AreaOIC"
tstats ... values(Eplanner.layers) as Data .... where ... Eplanner.layers="AreaOIC"
tstats ... values(Eplanner.typename) as Data .... where ... Eplanner.typename="AreaOIC"
... View more