The "UNKNOWN" user appears in reports from Pharos Blueprint Enterprise when a device meter feed is added to the configuration. When Blueprint imports meters for devices, there will always be a gap between the page volume the meter provides for the period and the page volume recorded by Tracker and Secure Release Here (SRH) for the period. This gap can either be positive (the meter count is higher than the volume established through combined Tracker/SRH data) or negative (the meter count is lower than the volume established through Tracker/SRH data).
Because there is a gap, the page counts are scaled to accommodate during publication (Blueprint 5) or Period Close (Blueprint 4.2 and lower). In the case of positive gaps, an UNKNOWN user is created to hold the excess. How UNKNOWN is handled varies in reports. For example, if a Budget Center report is pulled, the UNKNOWN volume for a device is assigned to the Budget Center defined for the device, or, if not configured this way, to the Budget Center who has the highest volume on the device. In the case of negative gaps, the Tracker data is scaled down proportionally across the device's users to fit the meter volume.
If you wish to determine what devices are providing the gap, the only option within Blueprint Reports is to run a Device Transaction report (in Blueprint 5, this is Supporting Material > Transactions > Device).
NOTE: Blueprint 5.0 includes integration with an application called Site Monitor by default. Site Monitor is an SNMP-based tool that utilizes the Connection information inside a device to obtain device meters.