Enscape - missing hostApplication.name

I am using the following ES|QL to identify Enscape usage.

FROM *enscape* 
| KEEP computer.name, user.name, hostApplication.name, hostApplication.version
| STATS user_count = COUNT(*) by computer.name, user.name, hostApplication.name, hostApplication.version

However, there are a number of results with the hostApplication.name is blank. What is this recording? Usage, or simply in Revit/Rhino not using the rendering engine?

In the last 90 days, this query returns 79 results. However, if I filter where the hostApplication.name is not blank, the number goes down to 43. Which case is more accurate?