I am having this same problem. Maybe I can add some clarity to the specific problem with a specific example. This is my search (minus the host data):  source="WinEventLog:Security" Keywords="Audit Failure" Failure_Reason="Unknown user name or bad password." | top Account_Name Looking in the events it returns, about 70% of the events have this: Account Name: - As well as: Account Name: actual user account name So when it outputs as a bar chart, the account name '-' shows as the largest, because it totals up every result that has that name in it, but it then also lists out the actual user account names. So the data is all listed twice in effect. But doing =! to the '-' user name ends up excluding the bulk of my other results, the info I am trying to track. Obviously this isn't the end of the world, I could just ignore that, but it does skew my bar charts a bit. ... View more