diff --git a/apps/emqx_auth_mnesia/src/emqx_auth_mnesia_api.erl b/apps/emqx_auth_mnesia/src/emqx_auth_mnesia_api.erl
index b09f99466..6e435ee11 100644
--- a/apps/emqx_auth_mnesia/src/emqx_auth_mnesia_api.erl
+++ b/apps/emqx_auth_mnesia/src/emqx_auth_mnesia_api.erl
@@ -133,7 +133,7 @@
 list_clientid(_Bindings, Params) ->
     SortFun = fun(#{created_at := C1}, #{created_at := C2}) -> C1 > C2 end,
     CountFun = fun() ->
-        MatchSpec = [{{?TABLE, {clientid, '_'}, '$1', '$2'}, [], [true]}],
+        MatchSpec = [{{?TABLE, {clientid, '_'}, '_', '_'}, [], [true]}],
         ets:select_count(?TABLE, MatchSpec)
                end,
     return({ok, emqx_mgmt_api:node_query(node(), Params, ?CLIENTID_SCHEMA, ?query_clientid, SortFun, CountFun)}).
@@ -187,7 +187,7 @@ delete_clientid(#{clientid := Clientid}, _) ->
 list_username(_Bindings, Params) ->
     SortFun = fun(#{created_at := C1}, #{created_at := C2}) -> C1 > C2 end,
     CountFun = fun() ->
-        MatchSpec = [{{?TABLE, {username, '_'}, '$1', '$2'}, [], [true]}],
+        MatchSpec = [{{?TABLE, {username, '_'}, '_', '_'}, [], [true]}],
         ets:select_count(?TABLE, MatchSpec)
                end,
     return({ok, emqx_mgmt_api:node_query(node(), Params, ?USERNAME_SCHEMA, ?query_username, SortFun, CountFun)}).
diff --git a/apps/emqx_auth_mnesia/test/emqx_auth_mnesia_SUITE.erl b/apps/emqx_auth_mnesia/test/emqx_auth_mnesia_SUITE.erl
index 508ff93b3..0253110aa 100644
--- a/apps/emqx_auth_mnesia/test/emqx_auth_mnesia_SUITE.erl
+++ b/apps/emqx_auth_mnesia/test/emqx_auth_mnesia_SUITE.erl
@@ -300,10 +300,10 @@ t_clientid_rest_api(_Config) ->
         = emqx_json:decode(Result4, [return_maps]),
 
     ?assertEqual(3, Count4),
-    ?assertEqual(3, length(Data4)),
+    ?assertEqual([<<"client2">>, <<"clientid1">>, ?CLIENTID],
+        lists:sort(lists:map(fun(#{<<"clientid">> := C}) -> C end, Data4))),
 
-    UserNameParams = [ #{<<"username">> => ?USERNAME, <<"password">> => ?PASSWORD}
-        , #{<<"username">> => <<"username1">>, <<"password">> => ?PASSWORD}
+    UserNameParams = [#{<<"username">> => <<"username1">>, <<"password">> => ?PASSWORD}
         , #{<<"username">> => <<"username2">>, <<"password">> => ?PASSWORD}
     ],
     {ok, _} = request_http_rest_add(["auth_username"], UserNameParams),
@@ -315,8 +315,9 @@ t_clientid_rest_api(_Config) ->
     {ok, Result42} = request_http_rest_list(["auth_username"]),
     #{<<"data">> := Data42, <<"meta">> := #{<<"count">> := Count42}}
         = emqx_json:decode(Result42, [return_maps]),
-    ?assertEqual(3, Count42),
-    ?assertEqual(3, length(Data42)),
+    ?assertEqual(2, Count42),
+    ?assertEqual([<<"username1">>, <<"username2">>],
+        lists:sort(lists:map(fun(#{<<"username">> := U}) -> U end, Data42))),
 
     {ok, Result5} = request_http_rest_list(["auth_clientid?_like_clientid=id"]),
     ?assertEqual(2, length(get_http_data(Result5))),